Quantcast
Channel: Active questions tagged gcc - Stack Overflow
Viewing all articles
Browse latest Browse all 21994

Reverse engineering assembly

$
0
0

Good day. I am struggling to figure out what the following assembly code does. The code is from objdump. To give it some background, a random "string" is generated (for example "68 7"). Before all this code the program does something recursively, whilst going through the ascii values one by one. It then asks the user for input. And then this is where I struggle. The program uses strtok for ":" and atoi, so I figure the input maybe has to look something like string:digit? The code can be found below:

#This first part I think only calculates the length of the input, malloc something and then takes strtok with ":" of it
 04bb74:    55                      push   ebp
 804bb75:   89 e5                   mov    ebp,esp
 804bb77:   83 ec 48                sub    esp,0x48
 804bb7a:   83 ec 0c                sub    esp,0xc
 804bb7d:   ff 75 08                push   DWORD PTR [ebp+0x8]
 804bb80:   e8 1b dd ff ff          call   80498a0 <strlen@plt>
 804bb85:   83 c4 10                add    esp,0x10
 804bb88:   83 ec 0c                sub    esp,0xc
 804bb8b:   50                      push   eax
 804bb8c:   e8 6f dc ff ff          call   8049800 <malloc@plt>
 804bb91:   83 c4 10                add    esp,0x10
 804bb94:   89 45 f0                mov    DWORD PTR [ebp-0x10],eax
 804bb97:   c7 45 ec 01 00 00 00    mov    DWORD PTR [ebp-0x14],0x1
 804bb9e:   83 ec 08                sub    esp,0x8
 804bba1:   ff 75 08                push   DWORD PTR [ebp+0x8]
 804bba4:   ff 75 f0                push   DWORD PTR [ebp-0x10]
 804bba7:   e8 f4 db ff ff          call   80497a0 <strcpy@plt>
 804bbac:   83 c4 10                add    esp,0x10
 804bbaf:   83 ec 08                sub    esp,0x8
 804bbb2:   68 be e9 08 08          push   0x808e9be
 804bbb7:   ff 75 f0                push   DWORD PTR [ebp-0x10]
 804bbba:   e8 11 de ff ff          call   80499d0 <strtok@plt>
 804bbbf:   83 c4 10                add    esp,0x10
 804bbc2:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bbc5:   83 ec 0c                sub    esp,0xc
 804bbc8:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bbcb:   e8 d0 dc ff ff          call   80498a0 <strlen@plt>
 804bbd0:   83 c4 10                add    esp,0x10
 804bbd3:   89 45 f4                mov    DWORD PTR [ebp-0xc],eax
 804bbd6:   83 7d e8 00             cmp    DWORD PTR [ebp-0x18],0x0 #Check to see if it is not empty
 804bbda:   75 0a                   jne    804bbe6 <phase_4+0x274>
 804bbdc:   b8 00 00 00 00          mov    eax,0x0
 804bbe1:   e9 f3 01 00 00          jmp    804bdd9 <phase_4+0x467> #QUIT

#The following bit is where my struggle starts. When I use the input "D:1" for example, the test eax,eax returns 0. This results in the program quitting. Why?
 804bbe6:   c7 45 e4 00 00 00 00    mov    DWORD PTR [ebp-0x1c],0x0
 804bbed:   eb 36                   jmp    804bc25 <phase_4+0x2b3>
 804bbef:   e8 bc df ff ff          call   8049bb0 <__ctype_b_loc@plt>
 804bbf4:   8b 00                   mov    eax,DWORD PTR [eax]
 804bbf6:   8b 4d e4                mov    ecx,DWORD PTR [ebp-0x1c]
 804bbf9:   8b 55 e8                mov    edx,DWORD PTR [ebp-0x18]
 804bbfc:   01 ca                   add    edx,ecx
 804bbfe:   0f b6 12                movzx  edx,BYTE PTR [edx]
 804bc01:   0f be d2                movsx  edx,dl
 804bc04:   01 d2                   add    edx,edx
 804bc06:   01 d0                   add    eax,edx
 804bc08:   0f b7 00                movzx  eax,WORD PTR [eax]
 804bc0b:   0f b7 c0                movzx  eax,ax
 804bc0e:   25 00 08 00 00          and    eax,0x800
 804bc13:   85 c0                   test   eax,eax
 804bc15:   75 0a                   jne    804bc21 <phase_4+0x2af> 
 804bc17:   b8 00 00 00 00          mov    eax,0x0
 804bc1c:   e9 b8 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bc21:   83 45 e4 01             add    DWORD PTR [ebp-0x1c],0x1
 804bc25:   8b 45 e4                mov    eax,DWORD PTR [ebp-0x1c]
 804bc28:   3b 45 f4                cmp    eax,DWORD PTR [ebp-0xc]
 804bc2b:   7c c2                   jl     804bbef <phase_4+0x27d>
 804bc2d:   83 ec 0c                sub    esp,0xc
 804bc30:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc33:   e8 48 de ff ff          call   8049a80 <atoi@plt>
 804bc38:   83 c4 10                add    esp,0x10
 804bc3b:   89 c1                   mov    ecx,eax
 804bc3d:   83 6d ec 01             sub    DWORD PTR [ebp-0x14],0x1
 804bc41:   8b 45 ec                mov    eax,DWORD PTR [ebp-0x14]
 804bc44:   8d 14 85 00 00 00 00    lea    edx,[eax*4+0x0]
 804bc4b:   8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
 804bc4e:   01 d0                   add    eax,edx
 804bc50:   8b 00                   mov    eax,DWORD PTR [eax]
 804bc52:   39 c1                   cmp    ecx,eax
 804bc54:   74 0a                   je     804bc60 <phase_4+0x2ee>
 804bc56:   b8 00 00 00 00          mov    eax,0x0
 804bc5b:   e9 79 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bc60:   83 ec 0c                sub    esp,0xc
 804bc63:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc66:   e8 95 de ff ff          call   8049b00 <atof@plt>
 804bc6b:   83 c4 10                add    esp,0x10
 804bc6e:   db 7d c8                fstp   TBYTE PTR [ebp-0x38]
 804bc71:   83 ec 0c                sub    esp,0xc
 804bc74:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc77:   e8 04 de ff ff          call   8049a80 <atoi@plt>
 804bc7c:   83 c4 10                add    esp,0x10
 804bc7f:   89 45 c4                mov    DWORD PTR [ebp-0x3c],eax
 804bc82:   db 45 c4                fild   DWORD PTR [ebp-0x3c]
 804bc85:   db 6d c8                fld    TBYTE PTR [ebp-0x38]
 804bc88:   de e1                   fsubp  st(1),st
 804bc8a:   db 2d c0 e9 08 08       fld    TBYTE PTR ds:0x808e9c0
 804bc90:   d9 c9                   fxch   st(1)
 804bc92:   df e9                   fucomip st,st(1)
 804bc94:   dd d8                   fstp   st(0)
 804bc96:   76 0a                   jbe    804bca2 <phase_4+0x330>
 804bc98:   b8 00 00 00 00          mov    eax,0x0
 804bc9d:   e9 37 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bca2:   83 ec 08                sub    esp,0x8
 804bca5:   68 be e9 08 08          push   0x808e9be
 804bcaa:   6a 00                   push   0x0
 804bcac:   e8 1f dd ff ff          call   80499d0 <strtok@plt>
 804bcb1:   83 c4 10                add    esp,0x10
 804bcb4:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bcb7:   e9 fa 00 00 00          jmp    804bdb6 <phase_4+0x444>
 804bcbc:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bcbf:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bcc2:   01 d0                   add    eax,edx
 804bcc4:   3b 45 18                cmp    eax,DWORD PTR [ebp+0x18]
 804bcc7:   7c 0a                   jl     804bcd3 <phase_4+0x361>
 804bcc9:   b8 00 00 00 00          mov    eax,0x0
 804bcce:   e9 06 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bcd3:   83 ec 0c                sub    esp,0xc
 804bcd6:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bcd9:   e8 c2 db ff ff          call   80498a0 <strlen@plt>
 804bcde:   83 c4 10                add    esp,0x10
 804bce1:   89 45 f4                mov    DWORD PTR [ebp-0xc],eax
 804bce4:   c7 45 e4 00 00 00 00    mov    DWORD PTR [ebp-0x1c],0x0
 804bceb:   eb 36                   jmp    804bd23 <phase_4+0x3b1>
 804bced:   e8 be de ff ff          call   8049bb0 <__ctype_b_loc@plt>
 804bcf2:   8b 00                   mov    eax,DWORD PTR [eax]
 804bcf4:   8b 4d e4                mov    ecx,DWORD PTR [ebp-0x1c]
 804bcf7:   8b 55 e8                mov    edx,DWORD PTR [ebp-0x18]
 804bcfa:   01 ca                   add    edx,ecx
 804bcfc:   0f b6 12                movzx  edx,BYTE PTR [edx]
 804bcff:   0f be d2                movsx  edx,dl
 804bd02:   01 d2                   add    edx,edx
 804bd04:   01 d0                   add    eax,edx
 804bd06:   0f b7 00                movzx  eax,WORD PTR [eax]
 804bd09:   0f b7 c0                movzx  eax,ax
 804bd0c:   25 00 08 00 00          and    eax,0x800
 804bd11:   85 c0                   test   eax,eax
 804bd13:   75 0a                   jne    804bd1f <phase_4+0x3ad>
 804bd15:   b8 00 00 00 00          mov    eax,0x0
 804bd1a:   e9 ba 00 00 00          jmp    804bdd9 <phase_4+0x467>
 804bd1f:   83 45 e4 01             add    DWORD PTR [ebp-0x1c],0x1
 804bd23:   8b 45 e4                mov    eax,DWORD PTR [ebp-0x1c]
 804bd26:   3b 45 f4                cmp    eax,DWORD PTR [ebp-0xc]
 804bd29:   7c c2                   jl     804bced <phase_4+0x37b>
 804bd2b:   83 ec 0c                sub    esp,0xc
 804bd2e:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd31:   e8 4a dd ff ff          call   8049a80 <atoi@plt>
 804bd36:   83 c4 10                add    esp,0x10
 804bd39:   89 c1                   mov    ecx,eax
 804bd3b:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bd3e:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bd41:   01 d0                   add    eax,edx
 804bd43:   8d 14 85 00 00 00 00    lea    edx,[eax*4+0x0]
 804bd4a:   8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
 804bd4d:   01 d0                   add    eax,edx
 804bd4f:   8b 00                   mov    eax,DWORD PTR [eax]
 804bd51:   39 c1                   cmp    ecx,eax
 804bd53:   74 07                   je     804bd5c <phase_4+0x3ea>
 804bd55:   b8 00 00 00 00          mov    eax,0x0
 804bd5a:   eb 7d                   jmp    804bdd9 <phase_4+0x467>
 804bd5c:   83 ec 0c                sub    esp,0xc
 804bd5f:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd62:   e8 99 dd ff ff          call   8049b00 <atof@plt>
 804bd67:   83 c4 10                add    esp,0x10
 804bd6a:   db 7d c8                fstp   TBYTE PTR [ebp-0x38]
 804bd6d:   83 ec 0c                sub    esp,0xc
 804bd70:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd73:   e8 08 dd ff ff          call   8049a80 <atoi@plt>
 804bd78:   83 c4 10                add    esp,0x10
 804bd7b:   89 45 c4                mov    DWORD PTR [ebp-0x3c],eax
 804bd7e:   db 45 c4                fild   DWORD PTR [ebp-0x3c]
 804bd81:   db 6d c8                fld    TBYTE PTR [ebp-0x38]
 804bd84:   de e1                   fsubp  st(1),st
 804bd86:   db 2d c0 e9 08 08       fld    TBYTE PTR ds:0x808e9c0
 804bd8c:   d9 c9                   fxch   st(1)
 804bd8e:   df e9                   fucomip st,st(1)
 804bd90:   dd d8                   fstp   st(0)
 804bd92:   76 07                   jbe    804bd9b <phase_4+0x429>
 804bd94:   b8 00 00 00 00          mov    eax,0x0
 804bd99:   eb 3e                   jmp    804bdd9 <phase_4+0x467>
 804bd9b:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bd9e:   01 45 ec                add    DWORD PTR [ebp-0x14],eax
 804bda1:   83 ec 08                sub    esp,0x8
 804bda4:   68 be e9 08 08          push   0x808e9be
 804bda9:   6a 00                   push   0x0
 804bdab:   e8 20 dc ff ff          call   80499d0 <strtok@plt>
 804bdb0:   83 c4 10                add    esp,0x10
 804bdb3:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bdb6:   83 7d e8 00             cmp    DWORD PTR [ebp-0x18],0x0
 804bdba:   0f 85 fc fe ff ff       jne    804bcbc <phase_4+0x34a>
 804bdc0:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bdc3:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bdc6:   01 d0                   add    eax,edx
 804bdc8:   3b 45 18                cmp    eax,DWORD PTR [ebp+0x18]
 804bdcb:   7d 07                   jge    804bdd4 <phase_4+0x462>
 804bdcd:   b8 00 00 00 00          mov    eax,0x0
 804bdd2:   eb 05                   jmp    804bdd9 <phase_4+0x467>
 804bdd4:   b8 01 00 00 00          mov    eax,0x1
 804bdd9:   c9                      leave  
 804bdda:   c3                      ret  

Thank you so much for your time.


Viewing all articles
Browse latest Browse all 21994

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>