That segment of code that Zach provided looks like strtok() built from the MS CRT source. When you install Visual Studio, you have the option to install the CRT source.Dann Corbit wrote:Where is the code that you claim to be strtok() or the entry point?
If the strtok() routine were in the CRT runtime DLL, we would see the reference or the program would not work.
If the strtok() routine were included from the CRT library, we would see the code inline with the _strtok symbol name. There could be a clone of strtok() somewhere. Will you show me where it is?
You will notice these easily:
1. The variables 4 match (3 DWORDS and a 32-byte array).
2. There is the call to _getptd().
3. Then there is the zeroing of the 32-byte array variable (8 stosd)
4. The very tight while loop that involves shift 3 to right, and 1 being shifted to the left in variable steps.
I could match the entire function, but I believe the point has been made.
The CRT library is liked statically to the EXE and then stripped of symbols.
Btw, ages ago, we used to have a disassembler that can identify common CRT functions even without symbols. It is specially easy with string functions.
Code: Select all
// I stripped out all the comments, and the 'secure' version
char * __cdecl strtok (
char * string,
const char * control
)
{
unsigned char *str;
const unsigned char *ctrl = control;
unsigned char map[32];
int count;
_ptiddata ptd = _getptd();
.text:0040EDFC push 8
.text:0040EDFE pop ecx
.text:0040EDFF mov [ebp+var_28], eax
.text:0040EE02 xor eax, eax
.text:0040EE04 lea edi, [ebp+var_24]
.text:0040EE07 push 7
.text:0040EE09 rep stosd
.text:0040EE0B pop edi
for (count = 0; count < 32; count++)
map[count] = 0;
text:0040EE0C mov dl, [esi]
.text:0040EE0E movzx ecx, dl
.text:0040EE11 mov eax, ecx
.text:0040EE13 and ecx, edi
.text:0040EE15 mov bl, 1
.text:0040EE17 shl bl, cl
.text:0040EE19 shr eax, 3
.text:0040EE1C lea eax, [ebp+eax+var_24]
.text:0040EE20 or [eax], bl
.text:0040EE22 inc esi
.text:0040EE23 test dl, dl
.text:0040EE25 jnz short loc_40EE0C
do {
map[*ctrl >> 3] |= (1 << (*ctrl & 7));
} while (*ctrl++);
if (string)
str = string;
else
str = _TOKEN;
while ( (map[*str >> 3] & (1 << (*str & 7))) && *str )
str++;
string = str;
for ( ; *str ; str++ )
if ( map[*str >> 3] & (1 << (*str & 7)) ) {
*str++ = '\0';
break;
}
_TOKEN = str;
if ( string == str )
return NULL;
else
return string;
}
