Joseph
Re: Solution
Sat Dec 19 17:56:16 1998


Phil and fellow newbies,

I was too quick pulling the trigger on Phil and the function the call to 403c04 does and wrongly I stated that it only compared a max of three points. That erroneous statement was due to the fact I neglected to take a closer look at what was done at earlier stage than the one I concentrated on and that was a Dword comparison at 00403C31 39D9 cmp ecx, ebx where the first 4 bytes are compared. After my apology to Phil and as an atonement for my sin I am presenting below the relevant parts of that procedure with brief comments on what is happening

:00403C27 :52 push edx ;edx=length of strings to be compared
:00403C28 C1EA02 shr edx, 02 ;edx=1 after shifts if length is 7 bytes
:00403C2B 7426 je 00403C53 ;go here if length is less than 7 bytes

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403C49(C)
|
:00403C2D 8B0E mov ecx, dword ptr [esi] ;points to real number
:00403C2F 8B1F mov ebx, dword ptr [edi] ;points to fake number
:00403C31 39D9 cmp ecx, ebx
:00403C33 7558 jne 00403C8D ;bad number, go away
:00403C35 4A dec edx
:00403C36 7415 je 00403C4D ;go here if length is more than 7 bytes
;else bring some more bytes
[snip...snip]

:00403C4D 83C604 add esi, 00000004 ;adjest esi to point to last 3 bytes
:00403C50 83C704 add edi, 00000004 ;adjest edi to point to last 3 bytes

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403C2B(C), :00403C4B(U)
|
:00403C53 5A pop edx ;restore edx
:00403C54 83E203 and edx, 00000003 ;make sure to do no more that 3 bytes
:00403C57 7422 je 00403C7B ;nothing more to be done, go to finished
:00403C59 8B0E mov ecx, dword ptr [esi] ;bring last part of real ecx
:00403C5B 8B1F mov ebx, dword ptr [edi] ;bring last part of fake to ebx
:00403C5D 38D9 cmp cl, bl ;compare the first set of bytes
:00403C5F 7541 jne 00403CA2 ;bad number go away
:00403C61 4A dec edx ;are there more bytes to compare
:00403C62 7417 je 00403C7B ;go here if nothing more to do
:00403C64 38FD cmp ch, bh ;compare the second set of bytes
:00403C66 753A jne 00403CA2 ;go away, bad number
:00403C68 4A dec edx ;are there more bytes to compare
:00403C69 7410 je 00403C7B ;nothing more to be done, go to finished
:00403C6B 81E30000FF00 and ebx, 00FF0000 ;nothing but the 3rd byte
:00403C71 81E10000FF00 and ecx, 00FF0000
:00403C77 39D9 cmp ecx, ebx ;compare the 3rd set of bytes
:00403C79 7527 jne 00403CA2 ;bad number, go away

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403C57(C), :00403C62(C), :00403C69(C)
|
:00403C7B 01C0 add eax, eax ;finished, the comparison was successful
:00403C7D EB23 jmp 00403CA2


:00403CA2 5F pop edi
:00403CA3 5E pop esi
:00403CA4 5B pop ebx
:00403CA5 C3 ret