0

Look at the following pseudocode:

void *__cdecl func(const char *a1, int a2, void *a3)
{
  _DWORD *v3; // esi
  int v5; // ebp
  int v6; // eax
  void *v7; // esi
  _DWORD *v8; // eax
  int v9; // edx
  int v10; // edi
  Elf32_Dyn *v11; // edx
  union Elf32_Dyn::$A263394DDF3EC2D4B1B8448EDD30E249 *v12; // edi
  Elf32_Dyn *v13; // esi
  Elf32_Dyn *v14; // edx
  _DWORD *v15; // [esp+20h] [ebp-1Ch]

  if ( !*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)(&dword_466640 - 694731)) )
  {
    v3 = *(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)&loc_2A647D - 2778921);
    if ( *v3 == 3 )
      return 0;
    ......

!*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)(&dword_466640 - 694731))and*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)&loc_2A647D - 2778921) is a mess! And this kind of mess is all over the whole binary. The disassembly code for the pseudocode is:

.text:002A6720 56                                                              push    esi
.text:002A6721 57                                                              push    edi
.text:002A6722 53                                                              push    ebx
.text:002A6723 55                                                              push    ebp
.text:002A6724 83 EC 2C                                                        sub     esp, 2Ch
.text:002A6727 E8 00 00 00 00                                                  call    $+5
.text:002A672C
.text:002A672C                                                 loc_2A672C:                             ; DATA XREF: loadLibraryExt1+FD↓r
.text:002A672C 5B                                                              pop     ebx
.text:002A672D 8D 9B C8 88 29 00                                               lea     ebx, (off_53EFF4 - 2A672Ch)[ebx]
.text:002A6733 83 BB 14 FF 1B 00 00                                            cmp     ds:(dword_466640 - 2A672Ch)[ebx], 0
.text:002A673A 75 43                                                           jnz     short loc_2A677F
.text:002A673C 8B B3 54 FD FF FF                                               mov     esi, dword ptr ds:(loc_2A647D+3 - 2A672Ch)[ebx]
.text:002A6742 83 3E 03                                                        cmp     dword ptr [esi], 3
.text:002A6745 75 0A                                                           jnz     short loc_2A6751
.text:002A6747
.text:002A6747                                                 loc_2A6747:                             ; CODE XREF: loadLibraryExt1+5D↓j
.text:002A6747 33 C0                                                           xor     eax, eax
.text:002A6749 83 C4 2C                                                        add     esp, 2Ch
.text:002A674C 5D                                                              pop     ebp
.text:002A674D 5B                                                              pop     ebx
.text:002A674E 5F                                                              pop     edi
.text:002A674F 5E                                                              pop     esi
.text:002A6750 C3                                                              retn

off_53EFF4 locates at the start of .got.plt section, this pseudocode is hard to read, and it only exists in x86 but x86_64. Why does this happen? How to solve this?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.