Question

I am sorry i know this is a really noobish question but can someone see this code and explain what this code is supposed to do, and delphi 7 keeps giving me error on the line begin stating expecting : or ,

{$IFDEF CRYPT_BLOCK}
  nested blocks not allowed!
{$ENDIF}
{$DEFINE CRYPT_BLOCK}
{$IFOPT O+}
  {$DEFINE SAVE_OPT}
{$ENDIF}
{$O-}
{$IfNDef UNSAFE_CRYPT}
begin
{$ENDIF}
asm db   $EB, $06, $EB, $FC, $EB, $FC, $FF, $F8 end;

Thanks

Answer 1

Step-by-step;

{$IFDEF CRYPT_BLOCK}
  nested blocks not allowed!
{$ENDIF}

I assume this code is somehow {$INCLUDE}-ed. This code doesn’t want to be included twice, so it will (later) define the precompiler symbol CRYPT_BLOCK; The code above tests if the symbol is defined {$IFDEF CRYPT_BLOCK} and if it is then it does something that’s not going to compile (nested blocks not allowed!). When the programmer sees that she’s going to know she {$INCLUDE} -ed this stuff twice.

{$DEFINE CRYPT_BLOCK}

This defines the symbol that’s tested with the block above. If the compiler got here without complaints then the symbol hasn’t already been defined.

{$IFOPT O+}
  {$DEFINE SAVE_OPT}
{$ENDIF}

Checks whether compiler optimization is enabled. If it is then the symbol SAVE_OPT is defined, so that the compiler option can be restored. When we see this we assume the code is going to change the {$O} compiler option.

{$O-}

Sure enough, optimization is now disabled.

{$IfNDef UNSAFE_CRYPT}
begin
{$ENDIF}

If the symbol UNSAFE_CRYPT is not defined then let the compiler see a begin keyword.

asm db   $EB, $06, $EB, $FC, $EB, $FC, $FF, $F8 end;

This is just a bit of scary assembler code; Someone’s idea of “obfuscating” code; Not a very good idea. The first two bytes ($EB, $06) is a relative jump to exactly after all this code. In other words, you could include this series of assembly almost anywhere, the CPU will simply jump over it. Then follows a weird series of jumps, the second $Eb $FC is actually a jump to where the first jump would be, and so one. The final two bytes ($FF, $F8) don’t actually make any sense (they’re not valid Intel x86 instructions) so I assume that’s ome kind of payload.