Skip to content

Commit 37d86c3

Browse files
committed
Added assembly-2
1 parent ee15f2c commit 37d86c3

File tree

5 files changed

+82
-10
lines changed

5 files changed

+82
-10
lines changed

Reversing/assembly-2/README.md

Lines changed: 45 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,54 @@ Reversing
1111
>assembly [conditions](https://www.tutorialspoint.com/assembly_programming/assembly_conditions.htm)
1212
1313
## Solution
14+
Compile the asm together with another function that calls the _asm2_ function and prints it out
15+
1416
```asm
15-
; [ebp + 0xc] = 0x28
16-
; [ebp + 0x8] = 0x7
17+
[0x000011f4]> pdf
18+
/ (fcn) loc.asm2 44
19+
| loc.asm2 (int arg_8h, int arg_ch);
20+
| ; var int local_8h @ ebp-0x8
21+
| ; var int local_4h @ ebp-0x4
22+
| ; arg int arg_8h @ ebp+0x8
23+
| ; arg int arg_ch @ ebp+0xc
24+
| ; CALL XREF from sym.main (0x11ca)
25+
| 0x000011f4 55 push ebp
26+
| 0x000011f5 89e5 mov ebp, esp
27+
| 0x000011f7 83ec10 sub esp, 0x10
28+
| 0x000011fa 8b450c mov eax, dword [arg_ch] ; [0xc:4]=0
29+
| 0x000011fd 8945fc mov dword [local_4h], eax
30+
| 0x00001200 8b4508 mov eax, dword [arg_8h] ; [0x8:4]=0
31+
| 0x00001203 8945f8 mov dword [local_8h], eax
32+
| ,=< 0x00001206 eb08 jmp loc.part_b
33+
| | ;-- part_a:
34+
| .--> 0x00001208 8345fc01 add dword [local_4h], 1
35+
| :| 0x0000120c 83450876 add dword [arg_8h], 0x76 ; 'v'
36+
| :| ;-- part_b:
37+
| :| ; CODE XREF from loc.asm2 (0x1206)
38+
| :`-> 0x00001210 817d08dea100. cmp dword [arg_8h], 0xa1de ; [0xa1de:4]=-1
39+
| `==< 0x00001217 7eef jle loc.part_a
40+
| 0x00001219 8b45fc mov eax, dword [local_4h]
41+
| 0x0000121c 89ec mov esp, ebp
42+
| 0x0000121e 5d pop ebp
43+
\ 0x0000121f c3 ret
44+
```
1745

18-
; [ebp - 0x4] = 0x28
19-
; [ebp-0x8] = 0x7
46+
```
47+
$ make all
48+
gcc -m32 -c loop.s -o loop.o
49+
gcc -m32 -c solve.c -o solve.o
50+
solve.c: In function ‘main’:
51+
solve.c:4:28: warning: implicit declaration of function ‘asm2’ [-Wimplicit-function-declaration]
52+
printf("Flag: 0x%x\n", asm2(0x7, 0x28));
53+
^~~~
54+
gcc -m32 -o a.out solve.o loop.o
55+
./a.out
56+
Flag: 0x188
57+
```
2058

21-
; 0x7 < 0a1de
22-
; [ebp - 0x4] = 0x29
23-
; [ebp + 0x8] = 0x7d
59+
Working solution [solve.sh](solution/solve.sh)
2460

25-
; eax = 0x29
26-
```
61+
Thanks to [@LFlare](https://github.com/LFlare) for basically solving this.
2762

2863
### Flag
29-
``
64+
`0x188`
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
all:
2+
gcc -m32 -c loop.s -o loop.o
3+
gcc -m32 -c solve.c -o solve.o
4+
gcc -m32 -o a.out solve.o loop.o
5+
./a.out
6+
clean:
7+
rm a.out *.o

Reversing/assembly-2/solution/loop.s

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
.intel_syntax noprefix
2+
3+
.global asm2
4+
5+
asm2:
6+
push ebp
7+
mov ebp,esp
8+
sub esp,0x10
9+
mov eax,DWORD PTR [ebp+0xc]
10+
mov DWORD PTR [ebp-0x4],eax
11+
mov eax,DWORD PTR [ebp+0x8]
12+
mov DWORD PTR [ebp-0x8],eax
13+
jmp part_b
14+
part_a:
15+
add DWORD PTR [ebp-0x4],0x1
16+
add DWORD PTR [ebp+0x8],0x76
17+
part_b:
18+
cmp DWORD PTR [ebp+0x8],0xa1de
19+
jle part_a
20+
mov eax,DWORD PTR [ebp-0x4]
21+
mov esp,ebp
22+
pop ebp
23+
ret

Reversing/assembly-2/solution/solve.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#include <stdio.h>
2+
3+
int main() {
4+
printf("Flag: 0x%x\n", asm2(0x7, 0x28));
5+
}
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/sh
2+
make all

0 commit comments

Comments
 (0)