📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  How do I make Bit Test set the Carry Flag?

Topic created on: October 15, 2009 11:07 CDT by 5aLIVE .

I am trying to establish the format of a simple text file.

I've been analysing a subroutine that returns a pointer to a substring.

I can get it to handle the first substring properly.

The routine of interest to me is called twice. Each call returns a pointer to a substring.

On the second call to the routine, it returns a null pointer.
I know what the second substring should look like, I just can't seem to get the routine to return the pointer.

I believe this is the bit of code that could hold the answer.

005472A6 AND EAX,0FF <-EAX contains a character read from the text file
005472AB BT DWORD PTR DS:[EDX],EAX <-This pointer holds the value 00000000
005472AE JNB SHORT 005472B3 <-I *think* I need the carry flag to be set so as not to jump and start parsing the second string.

What character (if any) will set the carry flag? I have tried editing the text file with a hex editor and inserting 00 and FF so far, this didn't work.

I would have thought EAX = 00h would have set the CF to 1?

So I need to format the text like this substring_1?substring_2.

I just need to find the "separating" character "?" which will set the CF for the second string to be parsed. I confirmed this to work as expected by setting the CF to 1 by hand at the right time in the loop.


Thanks,
5aLIVE.

  cseagle     October 17, 2009 22:05.55 CDT
Per the x86 reference manual regarding BT: "The CF flag contains the value of the selected bit" so whatever bit you are testing needs to be set.

  5aLIVE   October 18, 2009 04:44.36 CDT
Thanks for replying Chris, the Intel manual wasn't all that clear to me but I figured it out in the end.

I would like to take this opportunity to congratulate you on your IDA Pro Book.  There are so few books available about RCE and fewer still that are any good.

Your text is immensely enjoyable to read and I learned a lot from it too.  It's an absolutely first class body of work.:)

Kind regards.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit