PDA

View Full Version : Ask help on algorithm analysis for this function?


bridgeic
October 16th, 2014, 04:37
case: as attached
command:test.exe -i testin.txt -o testout.txt

The 2nd time run at 0048AD40,

0048AD3D |. 50 PUSH EAX
0048AD3E |. 51 PUSH ECX
0048AD3F |. 56 PUSH ESI
0048AD40 |. E8 FB510100 CALL test._0x5056

EAX = 0012CFA8
ECX = 0012CEA8 (the values:7B E8 ......B1 3B)
ESI = 000000F5

0012CEA8 7B E8 9A 5D 34 86 29 67 E9 94 60 6B 53 28 EE 76
0012CEB8 3E 6E AA 88 7D 1F BA 7B CB C0 8B 34 B1 3B

After run through 0x5056, the values at 0012CFA8 will be as below.
0012CFA8 1C 00 00 00 47 01 00 00 7D 00 00 00 FE 00 00 00 ...G..}...?..
0012CFB8 D1 00 00 00 49 01 00 00 3D 01 00 00 17 00 00 00 ?..I..=.....
0012CFC8 38 01 00 00 06 01 00 00 7A 01 00 00 98 00 00 00 8....z..?..
0012CFD8 E5 01 00 00 D8 01 00 00 DF 01 00 00 17 00 00 00 ?..?..?.....
0012CFE8 E5 00 00 00 48 00 00 00 51 00 00 00 1C 00 00 00 ?..H...Q......
0012CFF8 F3 00 00 00 77 00 00 00 50 00 00 00 E0 00 00 00 ?..w...P...?..
0012D008 2F 00 00 00 E1 00 00 00 FA 00 00 00 31 00 00 00 /...?..?..1...
0012D018 51 00 00 00

Any friend can help to analysis the algorithm of function 0x5056, how data conversion below done?

7B E8 9A 5D 34 86 29 67 E9 94 60 6B 53 28 EE 76 3E 6E AA 88 7D 1F BA 7B CB C0 8B 34 B1 3B

=>

1C 00 00 00 47 01 00 00 7D 00 00 00 FE 00 00 00 D1 00 00 00 49 01 00 00 3D 01 00 00 17 00 00 00
38 01 00 00 06 01 00 00 7A 01 00 00 98 00 00 00 E5 01 00 00 D8 01 00 00 DF 01 00 00 17 00 00 00
E5 00 00 00 48 00 00 00 51 00 00 00 1C 00 00 00 F3 00 00 00 77 00 00 00 50 00 00 00 E0 00 00 00
2F 00 00 00 E1 00 00 00 FA 00 00 00 31 00 00 00 51 00 00 00

bridgeic
October 16th, 2014, 17:59
Bit-map related?