I am working on reverse engineering some code and am coming across some code that doesn't appear to make sense
For example
push 0x3C2D1C06
mov [esp], ebx
mov[esp], edx
mov dword ptr[esp], 0x7D0B46E7`
Is there logic behind this or is this something that comes from compiler generation. It occurs to me the this would net the same as
push 0x7D0B46E7
Another example is
pusha
push ecx
pop ecx
pusha
popa
popa
push eax
push edx
rdtsc
pusha
popa
pop edx
pop eax
I dont understand all of the push/pop combinations
EDIT:
I am really intrigued now on the root of this. I do have to believe that this is one of a few sources:
1.) As mentioned possible that this was done to obscure reverse engineering
2.) Some form of optimization that is over my head(I have a hard time seeing this one)
3.) Some form of compiler action linking possibly multi platform libraries or something
I am convinced that the code is disassembled correctly because the sequences may be odd the do not ever corrupt the stack etc. I am curious about some of the sequences such as
push edi
push eax
push eax
mov eax, 0x577D25CD
mov [esp], eax
push eax
pop edi
and edi, 0x3F7BEBDC
shl edi, 0x3
xor edi, 0x6E778451
sub edi, 0x0D5BE8A31
mov ebx, edi
push [esp]
pop edi
To start with
push edi
push eax
push eax
mov eax, 0x577D25CD
mov [esp], eax
pop eax
pop edi
I believe is the same as writing
push edi
push 0x577D25CD
pop edi
OR even
push edi
mov edi, 0x577D25CD
But even more confusing is what follows,
and edi(0x577D25CD), 0x3F7BEBDC ->edi=0x177921CC
shl edi(0x177921CC), 3 ->edi=0xBBC90E60
xor edi(0xBBC90E0), 0x6e778451 -> edi=0xD5BE8A31
sub edi(0x0D5BE8A31), 0x0D5BE8A31 -> edi=0x0
mov ebx, edi
So that could be replaced with
mov ebx, 0x0 OR xor ebx, ebx
So this leaves me with a few new questions. Is this point more firmly to a form of reverse engineering protection, are there tools that do this. Could there be any other logical reasons to execute a stream like this. Is it fair to assume that a compiler would not perform operations to set values below ESP, I have not found indications that any of the values below ESP are used
A couple last points, I have started distilling the code down to just the effective result and so far everything thing works as before and i've removed over 200bytes of code. This further points me to the idea that I'm correctly interpreting the code. I also find it hard to believe incorrectly disassembled code would produce a sequence of xor, and, shl operations that exactly equal 0x00
EDIT 2:
I can assuredly say this is code I am interpreting. I focused in on one section, I posted a portion of it in my first edit and when I sorted through the 86 asm instructions I found the result was simply this
start:
test ebx, ebx
jz end
add [eax], ecx
add eax, 0x04
sub ebx, 0x1
jmp start
end:
The rest was as mentioned before "clobbering" the stack with odd combinations of pushes, pops, xchgs, and arithmetic on the esp. Sometimes there was something like add esp, 0x4 then mov [esp], eax which is the same as push eax In the end the section I worked through was offsetting an array of addresses by the Image_Base, a form of relocation I guess. When I peek the relocated addresses they point to code segments and what looks like the start of procedures. I have a hard time seeing someone writing the thousands of lines of code that appear to do this which makes me wonder..
Does anyone know of a tool that does this. Has someone created a program that takes code and obscures it with nonsense to prevent reverse engineering.
asmdirective. That timing code almost looks valid, but the reason for all the successive push and pops I don't understand. There is no reason to believe that MSVC code generator actually generated these sequences of bytes, a human must have. even the most unoptimized MSVC code would not generate code with push/pop's like that unless the porgrammer coded them that way himself. Programs written in assembly can also link the MSVCRT runtime as well.rdtsc. I'm pretty sure there's no way (other than inline asm) to get MSVC to emit that push / overwrite twice / overwrite with another constant, even with contrived code using avolatilefunction arg or something. If it was just repeated dead stores,volatilecould explain it, but thepushrules out just normal assignments to a variable. MSVC (like other x86 compilers) reserves space for locals withsub esp, imm