Reversing : The Hacker's Guide to Reverse Engineering

Figure 5.4 Binary tree after third splaying step. The new item has been moved up by yet

another level.

7C9215BB PUSH EBP

7C9215BC MOV EBP,ESP

7C9215BE LEA EAX,DWORD PTR [EBP+C]

7C9215C1 PUSH EAX

7C9215C2 LEA EAX,DWORD PTR [EBP+8]

7C9215C5 PUSH EAX

7C9215C6 PUSH DWORD PTR [EBP+C]

7C9215C9 PUSH DWORD PTR [EBP+8]

7C9215CC CALL ntdll.7C9215DA

7C9215D1 POP EBP

7C9215D2 RET 8

Listing 5.8 Disassembly of RtlLookupElementGenericTable.

113

58

130

31 82

119 146

124

13 35 90

71

4

74

Root Node

Item We’ve

Just Added

190 Chapter 5