Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  How do I make Bit Test set the Carry Flag?

Topic created on: October 15, 2009 11:07 CDT by 5aLIVE .

I am trying to establish the format of a simple text file.

I've been analysing a subroutine that returns a pointer to a substring.

I can get it to handle the first substring properly.

The routine of interest to me is called twice. Each call returns a pointer to a substring.

On the second call to the routine, it returns a null pointer.
I know what the second substring should look like, I just can't seem to get the routine to return the pointer.

I believe this is the bit of code that could hold the answer.

005472A6 AND EAX,0FF <-EAX contains a character read from the text file
005472AB BT DWORD PTR DS:[EDX],EAX <-This pointer holds the value 00000000
005472AE JNB SHORT 005472B3 <-I *think* I need the carry flag to be set so as not to jump and start parsing the second string.

What character (if any) will set the carry flag? I have tried editing the text file with a hex editor and inserting 00 and FF so far, this didn't work.

I would have thought EAX = 00h would have set the CF to 1?

So I need to format the text like this substring_1?substring_2.

I just need to find the "separating" character "?" which will set the CF for the second string to be parsed. I confirmed this to work as expected by setting the CF to 1 by hand at the right time in the loop.


Thanks,
5aLIVE.

  cseagle     October 17, 2009 22:05.55 CDT
Per the x86 reference manual regarding BT: "The CF flag contains the value of the selected bit" so whatever bit you are testing needs to be set.

  5aLIVE   October 18, 2009 04:44.36 CDT
Thanks for replying Chris, the Intel manual wasn't all that clear to me but I figured it out in the end.

I would like to take this opportunity to congratulate you on your IDA Pro Book.  There are so few books available about RCE and fewer still that are any good.

Your text is immensely enjoyable to read and I learned a lot from it too.  It's an absolutely first class body of work.:)

Kind regards.

Note: Registration is required to post to the forums.

There are 28,226 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit