Reverse Engineering for Beginners

(avery) #1

CHAPTER 86. ORACLE RDBMS: .SYM-FILES CHAPTER 86. ORACLE RDBMS: .SYM-FILES


We will add red lines to divide the block:


Figure 86.4:Binary block patterns

Hiew, like almost any other hexadecimal editor, shows 16 bytes per line. So the pattern is clearly visible: there are 4 32-bit
values per line.


The pattern is visually visible because some values here (till address0x104) are always in0x1000xxxxform, started with
0x10 and zero bytes. Other values (starting at0x108) are in0x0000xxxxform, so always started with two zero bytes.


Let’s dump the block as an array of 32-bit values:


Listing 86.1: first column is address

$ od -v -t x4 binary_block
0000000 10001000 10001080 100010f0 10001150
0000020 10001160 100011c0 100011d0 10001370
0000040 10001540 10001550 10001560 10001580
0000060 100015a0 100015a6 100015ac 100015b2
0000100 100015b8 100015be 100015c4 100015ca
0000120 100015d0 100015e0 100016b0 10001760
0000140 10001766 1000176c 10001780 100017b0
0000160 100017d0 100017e0 10001810 10001816
0000200 10002000 10002004 10002008 1000200c
0000220 10002010 10002014 10002018 1000201c
0000240 10002020 10002024 10002028 1000202c
0000260 10002030 10002034 10002038 1000203c
0000300 10002040 10002044 10002048 1000204c
0000320 10002050 100020d0 100020e4 100020f8
0000340 1000210c 10002120 10003000 10003004
0000360 10003008 1000300c 10003098 1000309c
0000400 100030a0 100030a4 00000000 00000008
0000420 00000012 0000001b 00000025 0000002e
0000440 00000038 00000040 00000048 00000051

Free download pdf