Reverse Engineering: C++ for operator

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

more share options
Embed For WordPress.com

Without related presentations

0 comments

Notes on slide 1

1 Favorite

apprenti - qualifiziert den Handel at apprenti - qualifiziert den Handel, favorited this 3 months ago

Reverse Engineering: C++ for operator - Presentation Transcript

C++ for operator
How does C++ for operator truly look like
He doesn’t know this
She doesn’t know this either
... he doesn’t even care
He definitely does!
do you
let’s take x86 Microsoft & Assembler Visual C++ and have a look …
_main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%x\" for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%x\", i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%x\" for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%x\", i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%x\" for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%x\", i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%x\" for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%x\", i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%x\" for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%x\", i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%x\" for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%x\", i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
How it could have been recognized in assembly
Quite simple. Just ...
by the presence of the instructions of… Counter changing Counter comparison Jumps
by the presence of the instructions of… Counter changing Counter comparison Jumps
_main proc near push esi xor esi, esi loc_401003: push esi push offset “%x\" call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: push esi push offset “%x\" call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
by the presence of the instructions of… Counter changing Counter comparison Jumps
by the presence of the instructions of… Counter changing Counter comparison Jumps
_main proc near push esi xor esi, esi loc_401003: push esi push offset “%x\" call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: push esi push offset “%x\" call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
by the presence of the instructions of… Counter changing Counter comparison Jumps
by the presence of the instructions of… Counter changing Counter comparison Jumps
_main proc near push esi xor esi, esi loc_401003: push esi push offset “%x\" call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
_main proc near push esi xor esi, esi loc_401003: push esi push offset “%x\" call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
by the presence of the instructions of… Counter changing Counter comparison Jumps
And once again …
for contains instructions of … Counter changing Counter comparison Jumps
for contains instructions of … Counter changing Counter comparison Jumps
for contains instructions of … Counter changing Counter comparison Jumps
for contains instructions of … Counter changing Counter comparison Jumps