• Welcome to Valhalla Legends Archive.
 

Inverting pointers

Started by iago, September 28, 2005, 10:48 PM

Previous topic - Next topic

iago

I've been seeing a lot of code lately that inverts pointers (1's complement).. I was wondering what this tends to be used for? So far, I haven't made sense of it:

void __fastcall(int *arg0):
                lea     eax, [ecx+4]    ; ecx is a parameter; load the address of the second 32-bit value
                mov   [ecx], 0
                mov     [eax], eax ; store the address of the parameter in the parameter itself
                not     eax ; Invert the address of the second parameter
                mov     [ecx+8], eax ; Store the inverted address in the third 32-bit spot
                ret

I just can't figure out why they would invert the pointer and store it.  The array ends as:
arg[0]: 0x00000000
arg[1]: &arg[1]
arg[2]: ~&arg[1]

Does anybody know what use a structure like that is?

Thanks
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


Adron

I have seen it used with linked lists. A 1's complement pointer can mean end of list, pointing back to head or something like that.

iago

Why would they invert it for that, though? Wouldn't it make more sense to leave it as-is?

Linked list is making sense, though.  It looks like they're setting up some kind of data structure.  They call that little function probably 12 or 14 times on different parts of a large array.
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*