Dear All,
I have disasemble a non-mfc dll.I find the function __heap_init looks
strange.
(__heap_init you can find
it:DllMainCRTStartup–>CRT_INIT–>__heap_init).In the normal situation i
have seen, the __heap_init only do heapcreate and ___sbh_heap_init.
But the strange dll do another task: check the windows versions.
My question is how a dll project can generate the code and why need do
this?
Thsnks for the help.
PS:
Strange DLL:
sub_10008790 proc near ; CODE XREF: __CRT_INIT@12+1Ap
arg_0 = dword ptr 4
xor eax, eax
push 0 ; dwMaximumSize
cmp [esp+4+arg_0], eax
push 1000h ; dwInitialSize
setz al
push eax ; flOptions
call ds:HeapCreate
test eax, eax
mov hHeap, eax
jz short loc_100087E6
call sub_10008648 ;
;*****
;why need call this
;how to genetate this?
;********
cmp eax, 3
mov dword_1001336C, eax
jnz short loc_100087CC
push 3F8h
call sub_10009B0F
pop ecx
jmp short loc_100087D6
loc_100087CC: ; CODE XREF: sub_10008790+2Dj
cmp eax, 2
jnz short loc_100087E9
call sub_1000A360
loc_100087D6: ; CODE XREF: sub_10008790+3Aj
test eax, eax
jnz short loc_100087E9
push hHeap ; hHeap
call ds:HeapDestroy
loc_100087E6: ; CODE XREF: sub_10008790+1Ej
xor eax, eax
retn
loc_100087E9: ; CODE XREF: sub_10008790+3Fj
push 1
pop eax
retn
sub_10008790 endp
proc near ; CODE XREF: sub_10008790+20p
Buffer = byte ptr -122Ch
Filename = byte ptr -19Ch
VersionInformation= _OSVERSIONINFOA ptr -98h
var_4 = byte ptr -4
push ebp
mov ebp, esp
mov eax, 122Ch
call __alloca_probe
lea eax, [ebp+VersionInformation]
push ebx
push eax ; lpVersionInformation
mov [ebp+VersionInformation.dwOSVersionInfoSize], 94h
call ds:GetVersionExA.text:1000866D
test eax, eax
jz short loc_1000868B
cmp [ebp+VersionInformation.dwPlatformId], 2
jnz short loc_1000868B
cmp [ebp+VersionInformation.dwMajorVersion], 5
jb short loc_1000868B
push 1
pop eax
jmp loc_1000878D
lea eax, [ebp+Buffer]
push 1090h ; nSize
push eax ; lpBuffer
push offset a__msvcrt_heap_ ; lpName
call ds:GetEnvironmentVariableA
test eax, eax
jz loc_1000877A
xor ebx, ebx
lea ecx, [ebp+Buffer]
cmp [ebp+Buffer], bl
jz short loc_100086CD
mov al, [ecx]
cmp al, 61h
jl short loc_100086C8
cmp al, 7Ah
jg short loc_100086C8
sub al, 20h
mov [ecx], al
loc_100086C8: ; CODE XREF: sub_10008648+76j
inc ecx
cmp [ecx], bl
jnz short loc_100086BA
loc_100086CD: ; CODE XREF: sub_10008648+70j
lea eax, [ebp+Buffer]
push 16h
push eax
push offset a__global_heap_ ; “__GLOBAL_HEAP_SELECTED”
call _strncmp
add esp, 0Ch
test eax, eax
jnz short loc_100086EF
lea eax, [ebp+Buffer]
jmp short loc_10008738
loc_100086EF: ; CODE XREF: sub_10008648+9Dj
lea eax, [ebp+Filename]
push 104h ; nSize
push eax ; lpFilename
push ebx ; hModule
call ds:GetModuleFileNameA
cmp [ebp+Filename], bl
lea ecx, [ebp+Filename]
jz short loc_10008723
loc_10008710: ; CODE XREF: sub_10008648+D9j
mov al, [ecx]
cmp al, 61h
jl short loc_1000871E
cmp al, 7Ah
jg short loc_1000871E
sub al, 20h
mov [ecx], al
loc_1000871E: ; CODE XREF: sub_10008648+CCj
inc ecx
cmp [ecx], bl
jnz short loc_10008710
loc_10008723: ; CODE XREF: sub_10008648+C6j
lea eax, [ebp+Filename]
push eax
lea eax, [ebp+Buffer]
push eax
call _strstr
pop ecx
pop ecx
loc_10008738: ; CODE XREF: sub_10008648+A5j
cmp eax, ebx
jz short loc_1000877A
push 2Ch
push eax
call _strchr
pop ecx
cmp eax, ebx
pop ecx
jz short loc_1000877A
inc eax
mov ecx, eax
cmp [eax], bl
jz short loc_1000875F
loc_10008751: ; CODE XREF: sub_10008648+115j
cmp byte ptr [ecx], 3Bh
jnz short loc_1000875A
mov [ecx], bl
jmp short loc_1000875B
loc_1000875A: ; CODE XREF: sub_10008648+10Cj
inc ecx
loc_1000875B: ; CODE XREF: sub_10008648+110j
cmp [ecx], bl
jnz short loc_10008751
loc_1000875F: ; CODE XREF: sub_10008648+107j
push 0Ah
push ebx
push eax
call _strtol
add esp, 0Ch
cmp eax, 2
jz short loc_1000878D
cmp eax, 3
jz short loc_1000878D
cmp eax, 1
jz short loc_1000878D
loc_1000877A: ; CODE XREF: sub_10008648+5Cj
lea eax, [ebp+var_4]
push eax
call sub_1000861B
cmp [ebp+var_4], 6
pop ecx
sbb eax, eax
add eax, 3
loc_1000878D: ; CODE XREF: sub_10008648+3Ej
pop ebx
leave
retn
sub_10008648 endp
NORMAL DLL:
Normal DLL:
__heap_init proc near ;CODEXREF:__CRT_INIT@12+1Ap
arg_0 = dword ptr 4
xor eax, eax
push 0 ; dwMaximumSize
cmp [esp+4+arg_0], eax
push 1000h ; dwInitialSize
setz al
push eax ; flOptions
call ds:HeapCreate
test eax, eax
mov hHeap, eax
jz short loc_100085C9
call ___sbh_heap_init
test eax, eax
jnz short loc_100085CC
push hHeap
call ds:HeapDestroy
xor eax, eax
retn
loc_100085CC:
push 1
pop eax
retn
__heap_init endp
ÓëÁª»úµÄÅóÓѽøÐн»Á÷£¬ÇëʹÓà MSN Messenger: http://messenger.msn.com/lccn/