SlideShare ist ein Scribd-Unternehmen logo
1 von 34
C++ for
operator
How does C++ for operator
     truly look like
He doesn’t know this
She doesn’t know this either
... he doesn’t even care
He definitely does!
do you
let’s take


     x86             Microsoft
              &
  Assembler          Visual C++

                  and have a look …
_main      proc near
        push esi
        xor esi, esi

loc_401003:
                              void _tmain(int argc, _TCHAR* argv[])
        push esi
                              {
        push offset “%xquot;
                                for (int i = 0; i < 255; ++i)
        call _printf
                                {
        add esp, 8
                                  printf(“%xquot;, i);
        inc esi
                                }
        cmp esi, 0FFh
                              }
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
                              void _tmain(int argc, _TCHAR* argv[])
        push esi
                              {
        push offset “%xquot;
                                for (int i = 0; i < 255; ++i)
        call _printf
                                {
        add esp, 8
                                  printf(“%xquot;, i);
        inc esi
                                }
        cmp esi, 0FFh
                              }
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
                              void _tmain(int argc, _TCHAR* argv[])
        push esi
                              {
        push offset “%xquot;
                                for (int i = 0; i < 255; ++i)
        call _printf
                                {
        add esp, 8
                                  printf(“%xquot;, i);
        inc esi
                                }
        cmp esi, 0FFh
                              }
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
                              void _tmain(int argc, _TCHAR* argv[])
        push esi
                              {
        push offset “%xquot;
                                for (int i = 0; i < 255; ++i)
        call _printf
                                {
        add esp, 8
                                  printf(“%xquot;, i);
        inc esi
                                }
        cmp esi, 0FFh
                              }
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
                              void _tmain(int argc, _TCHAR* argv[])
        push esi
                              {
        push offset “%xquot;
                                for (int i = 0; i < 255; ++i)
        call _printf
                                {
        add esp, 8
                                  printf(“%xquot;, i);
        inc esi
                                }
        cmp esi, 0FFh
                              }
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
                              void _tmain(int argc, _TCHAR* argv[])
        push esi
                              {
        push offset “%xquot;
                                for (int i = 0; i < 255; ++i)
        call _printf
                                {
        add esp, 8
                                  printf(“%xquot;, i);
        inc esi
                                }
        cmp esi, 0FFh
                              }
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
How it could have been
recognized in assembly
Quite simple. Just ...
by the presence of the
   instructions of…
  Counter changing

  Counter comparison

  Jumps
by the presence of the
   instructions of…
  Counter changing

  Counter comparison

  Jumps
_main      proc near
        push esi
        xor esi, esi

loc_401003:
        push esi
        push offset “%xquot;
        call _printf
        add esp, 8
        inc esi
        cmp esi, 0FFh
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
        push esi
        push offset “%xquot;
        call _printf
        add esp, 8
        inc esi
        cmp esi, 0FFh
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
by the presence of the
   instructions of…
  Counter changing

  Counter comparison

  Jumps
by the presence of the
   instructions of…
  Counter changing

  Counter comparison

  Jumps
_main      proc near
        push esi
        xor esi, esi

loc_401003:
        push esi
        push offset “%xquot;
        call _printf
        add esp, 8
        inc esi
        cmp esi, 0FFh
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
        push esi
        push offset “%xquot;
        call _printf
        add esp, 8
        inc esi
        cmp esi, 0FFh
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
by the presence of the
   instructions of…
  Counter changing

  Counter comparison

  Jumps
by the presence of the
   instructions of…
  Counter changing

  Counter comparison

  Jumps
_main      proc near
        push esi
        xor esi, esi

loc_401003:
        push esi
        push offset “%xquot;
        call _printf
        add esp, 8
        inc esi
        cmp esi, 0FFh
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
_main      proc near
        push esi
        xor esi, esi

loc_401003:
        push esi
        push offset “%xquot;
        call _printf
        add esp, 8
        inc esi
        cmp esi, 0FFh
        jl short loc_401003
        xor eax, eax
        pop esi
        retn
_main       endp
by the presence of the
   instructions of…
  Counter changing

  Counter comparison

  Jumps
And once again …
for contains instructions of …

     Counter changing

     Counter comparison

     Jumps
for contains instructions of …

     Counter changing

     Counter comparison

     Jumps
for contains instructions of …

     Counter changing

     Counter comparison

     Jumps
for contains instructions of …

     Counter changing

     Counter comparison

     Jumps

Weitere ähnliche Inhalte

Was ist angesagt?

Ping pong game
Ping pong  gamePing pong  game
Ping pong gameAmit Kumar
 
How the stack works(1)
How the stack works(1)How the stack works(1)
How the stack works(1)keithrozario
 
C++ Programming - 4th Study
C++ Programming - 4th StudyC++ Programming - 4th Study
C++ Programming - 4th StudyChris Ohk
 
โปรแกรมย่อยและฟังชันก์มาตรฐาน
โปรแกรมย่อยและฟังชันก์มาตรฐานโปรแกรมย่อยและฟังชันก์มาตรฐาน
โปรแกรมย่อยและฟังชันก์มาตรฐานknang
 
Data Structure - 2nd Study
Data Structure - 2nd StudyData Structure - 2nd Study
Data Structure - 2nd StudyChris Ohk
 
C++ Programming - 11th Study
C++ Programming - 11th StudyC++ Programming - 11th Study
C++ Programming - 11th StudyChris Ohk
 
C++の話(本当にあった怖い話)
C++の話(本当にあった怖い話)C++の話(本当にあった怖い話)
C++の話(本当にあった怖い話)Yuki Tamura
 
โครงงาน เครื่องคิดเลข
โครงงาน เครื่องคิดเลขโครงงาน เครื่องคิดเลข
โครงงาน เครื่องคิดเลขBung Lfkglialbmk
 
OSDC.TW - Gutscript for PHP haters
OSDC.TW - Gutscript for PHP hatersOSDC.TW - Gutscript for PHP haters
OSDC.TW - Gutscript for PHP hatersLin Yo-An
 
C++ Programming - 3rd Study
C++ Programming - 3rd StudyC++ Programming - 3rd Study
C++ Programming - 3rd StudyChris Ohk
 
ภาษาซี
ภาษาซีภาษาซี
ภาษาซีkramsri
 
为什么 rust-lang 吸引我?
为什么 rust-lang 吸引我?为什么 rust-lang 吸引我?
为什么 rust-lang 吸引我?勇浩 赖
 
第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -
第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -
第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -Wataru Kani
 
Load-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOADLoad-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOADDharmalingam Ganesan
 

Was ist angesagt? (19)

Ping pong game
Ping pong  gamePing pong  game
Ping pong game
 
week-16x
week-16xweek-16x
week-16x
 
How the stack works(1)
How the stack works(1)How the stack works(1)
How the stack works(1)
 
C++ Programming - 4th Study
C++ Programming - 4th StudyC++ Programming - 4th Study
C++ Programming - 4th Study
 
โปรแกรมย่อยและฟังชันก์มาตรฐาน
โปรแกรมย่อยและฟังชันก์มาตรฐานโปรแกรมย่อยและฟังชันก์มาตรฐาน
โปรแกรมย่อยและฟังชันก์มาตรฐาน
 
Data Structure - 2nd Study
Data Structure - 2nd StudyData Structure - 2nd Study
Data Structure - 2nd Study
 
C++ Programming - 11th Study
C++ Programming - 11th StudyC++ Programming - 11th Study
C++ Programming - 11th Study
 
C++の話(本当にあった怖い話)
C++の話(本当にあった怖い話)C++の話(本当にあった怖い話)
C++の話(本当にあった怖い話)
 
Tu1
Tu1Tu1
Tu1
 
โครงงาน เครื่องคิดเลข
โครงงาน เครื่องคิดเลขโครงงาน เครื่องคิดเลข
โครงงาน เครื่องคิดเลข
 
OSDC.TW - Gutscript for PHP haters
OSDC.TW - Gutscript for PHP hatersOSDC.TW - Gutscript for PHP haters
OSDC.TW - Gutscript for PHP haters
 
What is recursion?
What is recursion? What is recursion?
What is recursion?
 
C++ Programming - 3rd Study
C++ Programming - 3rd StudyC++ Programming - 3rd Study
C++ Programming - 3rd Study
 
Mona cheatsheet
Mona cheatsheetMona cheatsheet
Mona cheatsheet
 
ภาษาซี
ภาษาซีภาษาซี
ภาษาซี
 
为什么 rust-lang 吸引我?
为什么 rust-lang 吸引我?为什么 rust-lang 吸引我?
为什么 rust-lang 吸引我?
 
第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -
第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -
第二回 冬のスイッチ大勉強会 - FullColorLED & MPU-6050編 -
 
Functuon
FunctuonFunctuon
Functuon
 
Load-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOADLoad-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOAD
 

Ähnlich wie Reverse Engineering: C++ for operator

Code sources des fonctions table cp
Code sources des fonctions table cpCode sources des fonctions table cp
Code sources des fonctions table cpidhem110
 
Exploiting Memory Overflows
Exploiting Memory OverflowsExploiting Memory Overflows
Exploiting Memory OverflowsAnkur Tyagi
 
Programming ppt files (final)
Programming ppt files (final)Programming ppt files (final)
Programming ppt files (final)yap_raiza
 
Software to the slaughter
Software to the slaughterSoftware to the slaughter
Software to the slaughterQuinn Wilton
 
Unit 5 Foc
Unit 5 FocUnit 5 Foc
Unit 5 FocJAYA
 
¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...
¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...
¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...Software Guru
 
ITGM #9 - Коварный CodeType, или от segfault'а к работающему коду
ITGM #9 - Коварный CodeType, или от segfault'а к работающему кодуITGM #9 - Коварный CodeType, или от segfault'а к работающему коду
ITGM #9 - Коварный CodeType, или от segfault'а к работающему кодуdelimitry
 
Anatomy of a PHP Request ( UTOSC 2010 )
Anatomy of a PHP Request ( UTOSC 2010 )Anatomy of a PHP Request ( UTOSC 2010 )
Anatomy of a PHP Request ( UTOSC 2010 )Joseph Scott
 
エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理maruyama097
 
Basic ASM by @binaryheadache
Basic ASM by @binaryheadacheBasic ASM by @binaryheadache
Basic ASM by @binaryheadachecamsec
 
[FT-11][suhorng] “Poor Man's” Undergraduate Compilers
[FT-11][suhorng] “Poor Man's” Undergraduate Compilers[FT-11][suhorng] “Poor Man's” Undergraduate Compilers
[FT-11][suhorng] “Poor Man's” Undergraduate CompilersFunctional Thursday
 
When Bad Things Come In Good Packages
When Bad Things Come In Good PackagesWhen Bad Things Come In Good Packages
When Bad Things Come In Good PackagesSaumil Shah
 
Call Return Exploration
Call Return ExplorationCall Return Exploration
Call Return ExplorationPat Hawks
 

Ähnlich wie Reverse Engineering: C++ for operator (20)

Buffer OverFlow
Buffer OverFlowBuffer OverFlow
Buffer OverFlow
 
null Pune meet - Application Security: Code injection
null Pune meet - Application Security: Code injectionnull Pune meet - Application Security: Code injection
null Pune meet - Application Security: Code injection
 
Programming Homework Help
Programming Homework Help Programming Homework Help
Programming Homework Help
 
CompilersAndLibraries
CompilersAndLibrariesCompilersAndLibraries
CompilersAndLibraries
 
String Manipulation Function and Header File Functions
String Manipulation Function and Header File FunctionsString Manipulation Function and Header File Functions
String Manipulation Function and Header File Functions
 
Code sources des fonctions table cp
Code sources des fonctions table cpCode sources des fonctions table cp
Code sources des fonctions table cp
 
Exploiting Memory Overflows
Exploiting Memory OverflowsExploiting Memory Overflows
Exploiting Memory Overflows
 
Programming ppt files (final)
Programming ppt files (final)Programming ppt files (final)
Programming ppt files (final)
 
Software to the slaughter
Software to the slaughterSoftware to the slaughter
Software to the slaughter
 
Unit 5 Foc
Unit 5 FocUnit 5 Foc
Unit 5 Foc
 
¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...
¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...
¡Ups! código inseguro: detección, explotación y mitigación de vulnerabilidade...
 
ITGM #9 - Коварный CodeType, или от segfault'а к работающему коду
ITGM #9 - Коварный CodeType, или от segfault'а к работающему кодуITGM #9 - Коварный CodeType, или от segfault'а к работающему коду
ITGM #9 - Коварный CodeType, или от segfault'а к работающему коду
 
Anatomy of a PHP Request ( UTOSC 2010 )
Anatomy of a PHP Request ( UTOSC 2010 )Anatomy of a PHP Request ( UTOSC 2010 )
Anatomy of a PHP Request ( UTOSC 2010 )
 
The Stack and Buffer Overflows
The Stack and Buffer OverflowsThe Stack and Buffer Overflows
The Stack and Buffer Overflows
 
エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理
 
Functuon
FunctuonFunctuon
Functuon
 
Basic ASM by @binaryheadache
Basic ASM by @binaryheadacheBasic ASM by @binaryheadache
Basic ASM by @binaryheadache
 
[FT-11][suhorng] “Poor Man's” Undergraduate Compilers
[FT-11][suhorng] “Poor Man's” Undergraduate Compilers[FT-11][suhorng] “Poor Man's” Undergraduate Compilers
[FT-11][suhorng] “Poor Man's” Undergraduate Compilers
 
When Bad Things Come In Good Packages
When Bad Things Come In Good PackagesWhen Bad Things Come In Good Packages
When Bad Things Come In Good Packages
 
Call Return Exploration
Call Return ExplorationCall Return Exploration
Call Return Exploration
 

Kürzlich hochgeladen

[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxKatpro Technologies
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEarley Information Science
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonetsnaman860154
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 

Kürzlich hochgeladen (20)

[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 

Reverse Engineering: C++ for operator

  • 2. How does C++ for operator truly look like
  • 4. She doesn’t know this either
  • 5. ... he doesn’t even care
  • 8. let’s take x86 Microsoft & Assembler Visual C++ and have a look …
  • 9. _main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%xquot; for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%xquot;, i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 10. _main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%xquot; for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%xquot;, i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 11. _main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%xquot; for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%xquot;, i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 12. _main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%xquot; for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%xquot;, i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 13. _main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%xquot; for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%xquot;, i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 14. _main proc near push esi xor esi, esi loc_401003: void _tmain(int argc, _TCHAR* argv[]) push esi { push offset “%xquot; for (int i = 0; i < 255; ++i) call _printf { add esp, 8 printf(“%xquot;, i); inc esi } cmp esi, 0FFh } jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 15. How it could have been recognized in assembly
  • 17. by the presence of the instructions of… Counter changing Counter comparison Jumps
  • 18. by the presence of the instructions of… Counter changing Counter comparison Jumps
  • 19. _main proc near push esi xor esi, esi loc_401003: push esi push offset “%xquot; call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 20. _main proc near push esi xor esi, esi loc_401003: push esi push offset “%xquot; call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 21. by the presence of the instructions of… Counter changing Counter comparison Jumps
  • 22. by the presence of the instructions of… Counter changing Counter comparison Jumps
  • 23. _main proc near push esi xor esi, esi loc_401003: push esi push offset “%xquot; call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 24. _main proc near push esi xor esi, esi loc_401003: push esi push offset “%xquot; call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 25. by the presence of the instructions of… Counter changing Counter comparison Jumps
  • 26. by the presence of the instructions of… Counter changing Counter comparison Jumps
  • 27. _main proc near push esi xor esi, esi loc_401003: push esi push offset “%xquot; call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 28. _main proc near push esi xor esi, esi loc_401003: push esi push offset “%xquot; call _printf add esp, 8 inc esi cmp esi, 0FFh jl short loc_401003 xor eax, eax pop esi retn _main endp
  • 29. by the presence of the instructions of… Counter changing Counter comparison Jumps
  • 31. for contains instructions of … Counter changing Counter comparison Jumps
  • 32. for contains instructions of … Counter changing Counter comparison Jumps
  • 33. for contains instructions of … Counter changing Counter comparison Jumps
  • 34. for contains instructions of … Counter changing Counter comparison Jumps