Quantcast
Channel: Active questions tagged gcc - Stack Overflow
Viewing all articles
Browse latest Browse all 22017

Binary Bomb phase 4 help (Reverse engineering) [duplicate]

$
0
0

This question is an exact duplicate of:

Good day. I'm struggling with phase 4 of the binary bomb. I have googled and saw a few questions regarding this phase. However, it is not the same as those on the internet. The phase still, as the other phases, fetches a number in the format "%d %d" (eg. 134 7) and then asks for input. I saw that it also needs a colon in the input, hence the strtok function. Would someone please help explaining what the following code snippet does? It will be greatly appreciated. I know it's a bunch of code but I think it's just repeated code, cause it kinda looks the same here and there.

 804bb74:   55                      push   ebp
 804bb75:   89 e5                   mov    ebp,esp
 804bb77:   83 ec 48                sub    esp,0x48
 804bb7a:   83 ec 0c                sub    esp,0xc
 804bb7d:   ff 75 08                push   DWORD PTR [ebp+0x8]
 804bb80:   e8 1b dd ff ff          call   80498a0 <strlen@plt>
 804bb85:   83 c4 10                add    esp,0x10
 804bb88:   83 ec 0c                sub    esp,0xc
 804bb8b:   50                      push   eax
 804bb8c:   e8 6f dc ff ff          call   8049800 <malloc@plt>
 804bb91:   83 c4 10                add    esp,0x10
 804bb94:   89 45 f0                mov    DWORD PTR [ebp-0x10],eax
 804bb97:   c7 45 ec 01 00 00 00    mov    DWORD PTR [ebp-0x14],0x1
 804bb9e:   83 ec 08                sub    esp,0x8
 804bba1:   ff 75 08                push   DWORD PTR [ebp+0x8]
 804bba4:   ff 75 f0                push   DWORD PTR [ebp-0x10]
 804bba7:   e8 f4 db ff ff          call   80497a0 <strcpy@plt>
 804bbac:   83 c4 10                add    esp,0x10
 804bbaf:   83 ec 08                sub    esp,0x8
 804bbb2:   68 be e9 08 08          push   0x808e9be
 804bbb7:   ff 75 f0                push   DWORD PTR [ebp-0x10]
 804bbba:   e8 11 de ff ff          call   80499d0 <strtok@plt>
 804bbbf:   83 c4 10                add    esp,0x10
 804bbc2:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bbc5:   83 ec 0c                sub    esp,0xc
 804bbc8:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bbcb:   e8 d0 dc ff ff          call   80498a0 <strlen@plt>
 804bbd0:   83 c4 10                add    esp,0x10
 804bbd3:   89 45 f4                mov    DWORD PTR [ebp-0xc],eax
 804bbd6:   83 7d e8 00             cmp    DWORD PTR [ebp-0x18],0x0 NOT EMPTY
 804bbda:   75 0a                   jne    804bbe6 <phase_4+0x274>
 804bbdc:   b8 00 00 00 00          mov    eax,0x0
 804bbe1:   e9 f3 01 00 00          jmp    804bdd9 <phase_4+0x467> QUIT
 804bbe6:   c7 45 e4 00 00 00 00    mov    DWORD PTR [ebp-0x1c],0x0
 804bbed:   eb 36                   jmp    804bc25 <phase_4+0x2b3>
 804bbef:   e8 bc df ff ff          call   8049bb0 <__ctype_b_loc@plt>
 804bbf4:   8b 00                   mov    eax,DWORD PTR [eax]
 804bbf6:   8b 4d e4                mov    ecx,DWORD PTR [ebp-0x1c]
 804bbf9:   8b 55 e8                mov    edx,DWORD PTR [ebp-0x18]
 804bbfc:   01 ca                   add    edx,ecx
 804bbfe:   0f b6 12                movzx  edx,BYTE PTR [edx]
 804bc01:   0f be d2                movsx  edx,dl
 804bc04:   01 d2                   add    edx,edx
 804bc06:   01 d0                   add    eax,edx
 804bc08:   0f b7 00                movzx  eax,WORD PTR [eax]
 804bc0b:   0f b7 c0                movzx  eax,ax
 804bc0e:   25 00 08 00 00          and    eax,0x800
 804bc13:   85 c0                   test   eax,eax
 804bc15:   75 0a                   jne    804bc21 <phase_4+0x2af> QUIT
 804bc17:   b8 00 00 00 00          mov    eax,0x0
 804bc1c:   e9 b8 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bc21:   83 45 e4 01             add    DWORD PTR [ebp-0x1c],0x1
 804bc25:   8b 45 e4                mov    eax,DWORD PTR [ebp-0x1c]
 804bc28:   3b 45 f4                cmp    eax,DWORD PTR [ebp-0xc]
 804bc2b:   7c c2                   jl     804bbef <phase_4+0x27d>
 804bc2d:   83 ec 0c                sub    esp,0xc
 804bc30:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc33:   e8 48 de ff ff          call   8049a80 <atoi@plt>
 804bc38:   83 c4 10                add    esp,0x10
 804bc3b:   89 c1                   mov    ecx,eax
 804bc3d:   83 6d ec 01             sub    DWORD PTR [ebp-0x14],0x1
 804bc41:   8b 45 ec                mov    eax,DWORD PTR [ebp-0x14]
 804bc44:   8d 14 85 00 00 00 00    lea    edx,[eax*4+0x0]
 804bc4b:   8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
 804bc4e:   01 d0                   add    eax,edx
 804bc50:   8b 00                   mov    eax,DWORD PTR [eax]
 804bc52:   39 c1                   cmp    ecx,eax
 804bc54:   74 0a                   je     804bc60 <phase_4+0x2ee>
 804bc56:   b8 00 00 00 00          mov    eax,0x0
 804bc5b:   e9 79 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bc60:   83 ec 0c                sub    esp,0xc
 804bc63:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc66:   e8 95 de ff ff          call   8049b00 <atof@plt>
 804bc6b:   83 c4 10                add    esp,0x10
 804bc6e:   db 7d c8                fstp   TBYTE PTR [ebp-0x38]
 804bc71:   83 ec 0c                sub    esp,0xc
 804bc74:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc77:   e8 04 de ff ff          call   8049a80 <atoi@plt>
 804bc7c:   83 c4 10                add    esp,0x10
 804bc7f:   89 45 c4                mov    DWORD PTR [ebp-0x3c],eax
 804bc82:   db 45 c4                fild   DWORD PTR [ebp-0x3c]
 804bc85:   db 6d c8                fld    TBYTE PTR [ebp-0x38]
 804bc88:   de e1                   fsubp  st(1),st
 804bc8a:   db 2d c0 e9 08 08       fld    TBYTE PTR ds:0x808e9c0
 804bc90:   d9 c9                   fxch   st(1)
 804bc92:   df e9                   fucomip st,st(1)
 804bc94:   dd d8                   fstp   st(0)
 804bc96:   76 0a                   jbe    804bca2 <phase_4+0x330>
 804bc98:   b8 00 00 00 00          mov    eax,0x0
 804bc9d:   e9 37 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bca2:   83 ec 08                sub    esp,0x8
 804bca5:   68 be e9 08 08          push   0x808e9be
 804bcaa:   6a 00                   push   0x0
 804bcac:   e8 1f dd ff ff          call   80499d0 <strtok@plt>
 804bcb1:   83 c4 10                add    esp,0x10
 804bcb4:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bcb7:   e9 fa 00 00 00          jmp    804bdb6 <phase_4+0x444>
 804bcbc:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bcbf:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bcc2:   01 d0                   add    eax,edx
 804bcc4:   3b 45 18                cmp    eax,DWORD PTR [ebp+0x18]
 804bcc7:   7c 0a                   jl     804bcd3 <phase_4+0x361>
 804bcc9:   b8 00 00 00 00          mov    eax,0x0
 804bcce:   e9 06 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bcd3:   83 ec 0c                sub    esp,0xc
 804bcd6:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bcd9:   e8 c2 db ff ff          call   80498a0 <strlen@plt>
 804bcde:   83 c4 10                add    esp,0x10
 804bce1:   89 45 f4                mov    DWORD PTR [ebp-0xc],eax
 804bce4:   c7 45 e4 00 00 00 00    mov    DWORD PTR [ebp-0x1c],0x0
 804bceb:   eb 36                   jmp    804bd23 <phase_4+0x3b1>
 804bced:   e8 be de ff ff          call   8049bb0 <__ctype_b_loc@plt>
 804bcf2:   8b 00                   mov    eax,DWORD PTR [eax]
 804bcf4:   8b 4d e4                mov    ecx,DWORD PTR [ebp-0x1c]
 804bcf7:   8b 55 e8                mov    edx,DWORD PTR [ebp-0x18]
 804bcfa:   01 ca                   add    edx,ecx
 804bcfc:   0f b6 12                movzx  edx,BYTE PTR [edx]
 804bcff:   0f be d2                movsx  edx,dl
 804bd02:   01 d2                   add    edx,edx
 804bd04:   01 d0                   add    eax,edx
 804bd06:   0f b7 00                movzx  eax,WORD PTR [eax]
 804bd09:   0f b7 c0                movzx  eax,ax
 804bd0c:   25 00 08 00 00          and    eax,0x800
 804bd11:   85 c0                   test   eax,eax
 804bd13:   75 0a                   jne    804bd1f <phase_4+0x3ad>
 804bd15:   b8 00 00 00 00          mov    eax,0x0
 804bd1a:   e9 ba 00 00 00          jmp    804bdd9 <phase_4+0x467>
 804bd1f:   83 45 e4 01             add    DWORD PTR [ebp-0x1c],0x1
 804bd23:   8b 45 e4                mov    eax,DWORD PTR [ebp-0x1c]
 804bd26:   3b 45 f4                cmp    eax,DWORD PTR [ebp-0xc]
 804bd29:   7c c2                   jl     804bced <phase_4+0x37b>
 804bd2b:   83 ec 0c                sub    esp,0xc
 804bd2e:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd31:   e8 4a dd ff ff          call   8049a80 <atoi@plt>
 804bd36:   83 c4 10                add    esp,0x10
 804bd39:   89 c1                   mov    ecx,eax
 804bd3b:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bd3e:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bd41:   01 d0                   add    eax,edx
 804bd43:   8d 14 85 00 00 00 00    lea    edx,[eax*4+0x0]
 804bd4a:   8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
 804bd4d:   01 d0                   add    eax,edx
 804bd4f:   8b 00                   mov    eax,DWORD PTR [eax]
 804bd51:   39 c1                   cmp    ecx,eax
 804bd53:   74 07                   je     804bd5c <phase_4+0x3ea>
 804bd55:   b8 00 00 00 00          mov    eax,0x0
 804bd5a:   eb 7d                   jmp    804bdd9 <phase_4+0x467>
 804bd5c:   83 ec 0c                sub    esp,0xc
 804bd5f:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd62:   e8 99 dd ff ff          call   8049b00 <atof@plt>
 804bd67:   83 c4 10                add    esp,0x10
 804bd6a:   db 7d c8                fstp   TBYTE PTR [ebp-0x38]
 804bd6d:   83 ec 0c                sub    esp,0xc
 804bd70:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd73:   e8 08 dd ff ff          call   8049a80 <atoi@plt>
 804bd78:   83 c4 10                add    esp,0x10
 804bd7b:   89 45 c4                mov    DWORD PTR [ebp-0x3c],eax
 804bd7e:   db 45 c4                fild   DWORD PTR [ebp-0x3c]
 804bd81:   db 6d c8                fld    TBYTE PTR [ebp-0x38]
 804bd84:   de e1                   fsubp  st(1),st
 804bd86:   db 2d c0 e9 08 08       fld    TBYTE PTR ds:0x808e9c0
 804bd8c:   d9 c9                   fxch   st(1)
 804bd8e:   df e9                   fucomip st,st(1)
 804bd90:   dd d8                   fstp   st(0)
 804bd92:   76 07                   jbe    804bd9b <phase_4+0x429>
 804bd94:   b8 00 00 00 00          mov    eax,0x0
 804bd99:   eb 3e                   jmp    804bdd9 <phase_4+0x467>
 804bd9b:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bd9e:   01 45 ec                add    DWORD PTR [ebp-0x14],eax
 804bda1:   83 ec 08                sub    esp,0x8
 804bda4:   68 be e9 08 08          push   0x808e9be
 804bda9:   6a 00                   push   0x0
 804bdab:   e8 20 dc ff ff          call   80499d0 <strtok@plt>
 804bdb0:   83 c4 10                add    esp,0x10
 804bdb3:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bdb6:   83 7d e8 00             cmp    DWORD PTR [ebp-0x18],0x0
 804bdba:   0f 85 fc fe ff ff       jne    804bcbc <phase_4+0x34a>
 804bdc0:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bdc3:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bdc6:   01 d0                   add    eax,edx
 804bdc8:   3b 45 18                cmp    eax,DWORD PTR [ebp+0x18]
 804bdcb:   7d 07                   jge    804bdd4 <phase_4+0x462>
 804bdcd:   b8 00 00 00 00          mov    eax,0x0
 804bdd2:   eb 05                   jmp    804bdd9 <phase_4+0x467>
 804bdd4:   b8 01 00 00 00          mov    eax,0x1
 804bdd9:   c9                      leave  
 804bdda:   c3                      ret  

Thank you so much for your time.


Viewing all articles
Browse latest Browse all 22017

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>