Nsryjdtyk

I have this piece of asm code that uses __ctype_b array, i'm trying to understand what it is, anybody know what is it doing?

ps: i know what __ctype_b_loc() is, this is different.

mov     eax, [rbp+counter]

cdqe

add     rax, [rbp+server_received_buffer]

movzx   eax, byte ptr [rax]

movsx   rax, al

add     rax, rax

mov     rdx, rax

mov     rax, cs:__ctype_b

lea     rax, [rdx+rax]

movzx   eax, word ptr [rax]

movzx   eax, ax

and     eax, 20h

test    eax, eax

I found the answer.
__ctype_b is an array that be used in "__isctype_l" macro:

#  define __isctype_l(c, type, locale) 

  ((locale)->__ctype_b[(int) (c)] & (unsigned short int) type)

and it is used here:

#  define __isalnum_l(c,l)  __isctype_l((c), _ISalnum, (l))

#  define __isalpha_l(c,l)  __isctype_l((c), _ISalpha, (l))

#  define __iscntrl_l(c,l)  __isctype_l((c), _IScntrl, (l))

#  define __isdigit_l(c,l)  __isctype_l((c), _ISdigit, (l))

#  define __islower_l(c,l)  __isctype_l((c), _ISlower, (l))

#  define __isgraph_l(c,l)  __isctype_l((c), _ISgraph, (l))

#  define __isprint_l(c,l)  __isctype_l((c), _ISprint, (l))

#  define __ispunct_l(c,l)  __isctype_l((c), _ISpunct, (l))

#  define __isspace_l(c,l)  __isctype_l((c), _ISspace, (l))

#  define __isupper_l(c,l)  __isctype_l((c), _ISupper, (l))

#  define __isxdigit_l(c,l) __isctype_l((c), _ISxdigit, (l))

#  define __isblank_l(c,l)  __isctype_l((c), _ISblank, (l))

then we will reach to this enum

enum

{

  _ISupper = _ISbit (0),    /* UPPERCASE.  */

  _ISlower = _ISbit (1),    /* lowercase.  */

  _ISalpha = _ISbit (2),    /* Alphabetic.  */

  _ISdigit = _ISbit (3),    /* Numeric.  */

  _ISxdigit = _ISbit (4),   /* Hexadecimal numeric.  */

  _ISspace = _ISbit (5),    /* Whitespace.  */

  _ISprint = _ISbit (6),    /* Printing.  */

  _ISgraph = _ISbit (7),    /* Graphical.  */

  _ISblank = _ISbit (8),    /* Blank (usually SPC and TAB).  */

  _IScntrl = _ISbit (9),    /* Control character.  */

  _ISpunct = _ISbit (10),   /* Punctuation.  */

  _ISalnum = _ISbit (11)    /* Alphanumeric.  */

};

now we need to understand what 0x20 is stand for from _ISbit definition

# if __BYTE_ORDER == __BIG_ENDIAN

#  define _ISbit(bit)   (1 << (bit))

# else /* __BYTE_ORDER == __LITTLE_ENDIAN */

#  define _ISbit(bit)   ((bit) < 8 ? ((1 << (bit)) << 8) : ((1 << (bit)) >> 8))

# endif

0x20 : 0010 0000

from the asm code i know it is big endian. so the shift number should be 5 and it is Whitespace.

Conclusion: that asm code finds Whitespace from the server_received_buffer