Right now I am playing around with a little training application I found on OpenSecurityTraining.
So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is the
je at lines
0x004010e7 which seem to be some
if conditions. But, I cannot figure out which condition should be met to take the jump instruction.
My workaround was to manipulate
eip when the
cmp line was executed. But, my question is what condition has to be set to take the
je instruction ?
004010e0 55 push ebp 004010e1 8bec mov ebp,esp 004010e3 837d0803 cmp dword ptr [ebp+8],3 004010e7 7412 je mystery!main+0x1b (004010fb) 004010e9 6834404200 push offset mystery!__rtc_tzz <PERF> (mystery+0x24034) (00424034) 004010ee e81c040000 call mystery!printf (0040150f) 004010f3 83c404 add esp,4 004010f6 83c8ff or eax,0FFFFFFFFh 004010f9 eb0b jmp mystery!main+0x26 (00401106) 004010fb e80affffff call mystery!mystery_function+0xffffffff`ffffffea (0040100a) 00401100 eb02 jmp mystery!main+0x24 (00401104) 00401102 eb02 jmp mystery!main+0x26 (00401106) 00401104 33c0 xor eax,eax 00401106 5d pop ebp 00401107 c3 ret