Why do you want to ignore the first byte that is read?


int main(int argc, char *argv[])
{
     /*Declare our variables. Data will be read into buff.
     Because we want to ignore the first byte that is read, we set buff_ptr to point one byte
     beyond the beginning of the buff character array.*/
     char buff[5];
     char *buff_ptr = buff+1;

Here is a great Reverse Engineering forum with great tutorials and video on Reverse Engineering.



http://community.reverse-engineering.net/

In the near future you should write an article just on pointers.


Nice article, thanks!

I like your reverse engineering articles.

 Intro to Reverse Engineering - Part 1 and 2

Please write more articles using ollydbg it is a nice program and I am trying to learn as much as I can with it..  I was having a hard time understanding assembly from the books I was reading, but your articles are clear.  Also here are some good reverse engineering videos I have been watching if you are interested..

http://www.tuts4you.com/download.php?list.17
They are Lena151's tutorials and are wonderful for learning.


Thanks, keep up the good work.

Great articles.  I am kind of confused about this part in your tutorial.

Press F8 until you arrive at the instruction 'MOV EAX, DWORD PTR DS:[403000]'. This instruction is moving the contents located at the memory address of 00403000 into the EAX register. The very next instruction moves the contents of EAX into a local variable on the stack starting 28 bytes below EBP.

Why is it 28 bytes below the base pointer?  Is that the amount the string "\nThis is a test application!\n" adds up to being?

So if the EBP is 0022FF78h  you are subtracting 28 bytes for the string storage on the stack?

I get confused with the assembly memory address and register math.

Thanks