I created a simple program in C and opened it in IDA. The program has a bug, but for the purposes of practicing reverse-engineering, I don't care. Also please note that I took my best stab at manually locating main in the midst of all of the noise in the PE and I may be off. I'm still not sure how the code went from the C code to the seemingly odd disassembly math:

C code:

#include <stdio.h>
#include <stdlib.h>

int main(){
    unsigned long int i, j;
    for(i = 0; i < 674828394819; i++){
        if(i % 1000000 == 0){
            printf("%d\n",i);
        }
    }
    return(EXIT_SUCCESS);
}

Disassembly:

.text:00401340 ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:00401340 main            proc near               ; CODE XREF: sub_401000+F8p
.text:00401340
.text:00401340 var_20          = dword ptr -20h
.text:00401340 var_1C          = dword ptr -1Ch
.text:00401340 var_4           = dword ptr -4
.text:00401340 argc            = dword ptr  8
.text:00401340 argv            = dword ptr  0Ch
.text:00401340 envp            = dword ptr  10h
.text:00401340
.text:00401340                 push    ebp
.text:00401341                 mov     ebp, esp
.text:00401343                 and     esp, 0FFFFFFF0h
.text:00401346                 sub     esp, 20h        ; char *
.text:00401349                 call    sub_401950
.text:0040134E                 mov     [esp+20h+var_4], 0
.text:00401356
.text:00401356 loc_401356:                             ; CODE XREF: main+4Fj
.text:00401356                 mov     ecx, [esp+20h+var_4] ; load var 4 into ecx
.text:0040135A                 mov     edx, 431BDE83h  ; load big number into edx
.text:0040135F                 mov     eax, ecx        ; mov the value in var 4 into eax and then multiply it times the big number
.text:00401361                 mul     edx
.text:00401363                 mov     eax, edx        ; put the result of the mult into eax
.text:00401365                 shr     eax, 12h        ; divide by 2^18 (0x12), store result in eax
.text:00401368                 imul    eax, 0F4240h    ; multiply result by 0x0F4240 which is 1 million, store in eax
.text:0040136E                 sub     ecx, eax        ; subtract the result of the mult from the var, store result in ecx
.text:00401370                 mov     eax, ecx        ; load the result in eax
.text:00401372                 test    eax, eax        ; is it 0? If not, jump to loc_40138A, otherwise put it in eax
.text:00401374                 jnz     short loc_40138A
.text:00401376                 mov     eax, [esp+20h+var_4] ; Set up format specifier and printf args
.text:0040137A                 mov     [esp+20h+var_1C], eax ; put the result into var_1C to be printed by printf
.text:0040137E                 mov     [esp+20h+var_20], offset aD ; "%d\n"
.text:00401385                 call    printf
.text:0040138A
.text:0040138A loc_40138A:                             ; CODE XREF: main+34j
.text:0040138A                 add     [esp+20h+var_4], 1
.text:0040138F                 jmp     short loc_401356
.text:0040138F main            endp

You can see what I understand from my comments, but I'm not sure how this translates into the original C code's functionality. My best guess is some compiler work which optimizes the code to perform the same math i % 1,000,000 but do so in a faster manner? var 4 = i in the for loop.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.