2

Look at the following pseudocode:

void *__cdecl func(const char *a1, int a2, void *a3)
{
  _DWORD *v3; // esi
  int v5; // ebp
  int v6; // eax
  void *v7; // esi
  _DWORD *v8; // eax
  int v9; // edx
  int v10; // edi
  Elf32_Dyn *v11; // edx
  union Elf32_Dyn::$A263394DDF3EC2D4B1B8448EDD30E249 *v12; // edi
  Elf32_Dyn *v13; // esi
  Elf32_Dyn *v14; // edx
  _DWORD *v15; // [esp+20h] [ebp-1Ch]

  if ( !*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)(&dword_466640 - 694731)) )
  {
    v3 = *(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)&loc_2A647D - 2778921);
    if ( *v3 == 3 )
      return 0;
    ......

!*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)(&dword_466640 - 694731))and*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)&loc_2A647D - 2778921) is a mess! And this kind of mess is all over the whole binary. The disassembly code for the pseudocode is:

.text:002A6720 56                                                              push    esi
.text:002A6721 57                                                              push    edi
.text:002A6722 53                                                              push    ebx
.text:002A6723 55                                                              push    ebp
.text:002A6724 83 EC 2C                                                        sub     esp, 2Ch
.text:002A6727 E8 00 00 00 00                                                  call    $+5
.text:002A672C
.text:002A672C                                                 loc_2A672C:                             ; DATA XREF: loadLibraryExt1+FD↓r
.text:002A672C 5B                                                              pop     ebx
.text:002A672D 8D 9B C8 88 29 00                                               lea     ebx, (off_53EFF4 - 2A672Ch)[ebx]
.text:002A6733 83 BB 14 FF 1B 00 00                                            cmp     ds:(dword_466640 - 2A672Ch)[ebx], 0
.text:002A673A 75 43                                                           jnz     short loc_2A677F
.text:002A673C 8B B3 54 FD FF FF                                               mov     esi, dword ptr ds:(loc_2A647D+3 - 2A672Ch)[ebx]
.text:002A6742 83 3E 03                                                        cmp     dword ptr [esi], 3
.text:002A6745 75 0A                                                           jnz     short loc_2A6751
.text:002A6747
.text:002A6747                                                 loc_2A6747:                             ; CODE XREF: loadLibraryExt1+5D↓j
.text:002A6747 33 C0                                                           xor     eax, eax
.text:002A6749 83 C4 2C                                                        add     esp, 2Ch
.text:002A674C 5D                                                              pop     ebp
.text:002A674D 5B                                                              pop     ebx
.text:002A674E 5F                                                              pop     edi
.text:002A674F 5E                                                              pop     esi
.text:002A6750 C3                                                              retn

off_53EFF4 locates at the start of .got.plt section, this pseudocode is hard to read, and it only exists in x86 but x86_64. Why does this happen? How to solve this?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.