I was reverse engineering a piece of code in "Crisis" for fun and I encountered the following :-
__INIT_STUB_hidden:00004B8F mov eax, 8FE00000h
__INIT_STUB_hidden:00004B94
__INIT_STUB_hidden:00004B94 loc_4B94:
__INIT_STUB_hidden:00004B94 mov ebx, 41424344h
__INIT_STUB_hidden:00004B99 cmp dword ptr [eax], 0FEEDFACEh
__INIT_STUB_hidden:00004B9F jz short loc_4BB9
__INIT_STUB_hidden:00004BA1 add eax, 1000h
__INIT_STUB_hidden:00004BA6 cmp eax, 8FFF1000h
__INIT_STUB_hidden:00004BAB jnz short loc_4B94
What is supposed to happen here? Why is the presence of FEEDFACE
expected at the address 8FFF0000
or 8FFF1000
? I understand that feedface
/feedfacf
are Mach-O magic numbers -- however why are they expected to be present at those addresses?