Reversing : The Hacker's Guide to Reverse Engineering

you’re seeing a call to RtlSplayimmediately after adding a new element (the

new element becomes the root of the tree), and you should also see a call to the

same function after deleting and even just searching for an element.

Figures 5.1 through 5.5 demonstrate how RtlSplayprogressively raises

the newly added item in the tree’s hierarchy until it becomes the root node.

RtlLookupElementGenericTable

Remember how before you started digging into the generic table I mentioned

two functions (RtlGetElementGenericTableand RtlLookupElement

GenericTable)that appeared to be responsible for retrieving elements?

Because you know that RtlGetElementGenericTablesearches for an ele-

ment by its index, RtlLookupElementGenericTablemust be the one that

provides some sort of search capabilities for a generic table. Let’s have a look

at RtlLookupElementGenericTable(see Listing 5.8).

Figure 5.1 Binary tree after adding a new item. New item is connected to the tree at the

most appropriate position, but no other items are moved.

113

58 130

31 82 119 146

13 35 71 90 124

4 74 Item We’veJust Added

Root Node

188 Chapter 5