Reverse engineering assembly

Question

Good day. I am struggling to figure out what the following assembly code does. The code is from objdump. To give it some background, a random "string" is generated (for example "68 7"). Before all this code the program does something recursively, whilst going through the ascii values one by one. It then asks the user for input. And then this is where I struggle. The program uses strtok for ":" and atoi, so I figure the input maybe has to look something like string:digit? The code can be found below:

#This first part I think only calculates the length of the input, malloc something and then takes strtok with ":" of it
 04bb74:    55                      push   ebp
 804bb75:   89 e5                   mov    ebp,esp
 804bb77:   83 ec 48                sub    esp,0x48
 804bb7a:   83 ec 0c                sub    esp,0xc
 804bb7d:   ff 75 08                push   DWORD PTR [ebp+0x8]
 804bb80:   e8 1b dd ff ff          call   80498a0 <strlen@plt>
 804bb85:   83 c4 10                add    esp,0x10
 804bb88:   83 ec 0c                sub    esp,0xc
 804bb8b:   50                      push   eax
 804bb8c:   e8 6f dc ff ff          call   8049800 <malloc@plt>
 804bb91:   83 c4 10                add    esp,0x10
 804bb94:   89 45 f0                mov    DWORD PTR [ebp-0x10],eax
 804bb97:   c7 45 ec 01 00 00 00    mov    DWORD PTR [ebp-0x14],0x1
 804bb9e:   83 ec 08                sub    esp,0x8
 804bba1:   ff 75 08                push   DWORD PTR [ebp+0x8]
 804bba4:   ff 75 f0                push   DWORD PTR [ebp-0x10]
 804bba7:   e8 f4 db ff ff          call   80497a0 <strcpy@plt>
 804bbac:   83 c4 10                add    esp,0x10
 804bbaf:   83 ec 08                sub    esp,0x8
 804bbb2:   68 be e9 08 08          push   0x808e9be
 804bbb7:   ff 75 f0                push   DWORD PTR [ebp-0x10]
 804bbba:   e8 11 de ff ff          call   80499d0 <strtok@plt>
 804bbbf:   83 c4 10                add    esp,0x10
 804bbc2:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bbc5:   83 ec 0c                sub    esp,0xc
 804bbc8:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bbcb:   e8 d0 dc ff ff          call   80498a0 <strlen@plt>
 804bbd0:   83 c4 10                add    esp,0x10
 804bbd3:   89 45 f4                mov    DWORD PTR [ebp-0xc],eax
 804bbd6:   83 7d e8 00             cmp    DWORD PTR [ebp-0x18],0x0 #Check to see if it is not empty
 804bbda:   75 0a                   jne    804bbe6 <phase_4+0x274>
 804bbdc:   b8 00 00 00 00          mov    eax,0x0
 804bbe1:   e9 f3 01 00 00          jmp    804bdd9 <phase_4+0x467> #QUIT

#The following bit is where my struggle starts. When I use the input "D:1" for example, the test eax,eax returns 0. This results in the program quitting. Why?
 804bbe6:   c7 45 e4 00 00 00 00    mov    DWORD PTR [ebp-0x1c],0x0
 804bbed:   eb 36                   jmp    804bc25 <phase_4+0x2b3>
 804bbef:   e8 bc df ff ff          call   8049bb0 <__ctype_b_loc@plt>
 804bbf4:   8b 00                   mov    eax,DWORD PTR [eax]
 804bbf6:   8b 4d e4                mov    ecx,DWORD PTR [ebp-0x1c]
 804bbf9:   8b 55 e8                mov    edx,DWORD PTR [ebp-0x18]
 804bbfc:   01 ca                   add    edx,ecx
 804bbfe:   0f b6 12                movzx  edx,BYTE PTR [edx]
 804bc01:   0f be d2                movsx  edx,dl
 804bc04:   01 d2                   add    edx,edx
 804bc06:   01 d0                   add    eax,edx
 804bc08:   0f b7 00                movzx  eax,WORD PTR [eax]
 804bc0b:   0f b7 c0                movzx  eax,ax
 804bc0e:   25 00 08 00 00          and    eax,0x800
 804bc13:   85 c0                   test   eax,eax
 804bc15:   75 0a                   jne    804bc21 <phase_4+0x2af> 
 804bc17:   b8 00 00 00 00          mov    eax,0x0
 804bc1c:   e9 b8 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bc21:   83 45 e4 01             add    DWORD PTR [ebp-0x1c],0x1
 804bc25:   8b 45 e4                mov    eax,DWORD PTR [ebp-0x1c]
 804bc28:   3b 45 f4                cmp    eax,DWORD PTR [ebp-0xc]
 804bc2b:   7c c2                   jl     804bbef <phase_4+0x27d>
 804bc2d:   83 ec 0c                sub    esp,0xc
 804bc30:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc33:   e8 48 de ff ff          call   8049a80 <atoi@plt>
 804bc38:   83 c4 10                add    esp,0x10
 804bc3b:   89 c1                   mov    ecx,eax
 804bc3d:   83 6d ec 01             sub    DWORD PTR [ebp-0x14],0x1
 804bc41:   8b 45 ec                mov    eax,DWORD PTR [ebp-0x14]
 804bc44:   8d 14 85 00 00 00 00    lea    edx,[eax*4+0x0]
 804bc4b:   8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
 804bc4e:   01 d0                   add    eax,edx
 804bc50:   8b 00                   mov    eax,DWORD PTR [eax]
 804bc52:   39 c1                   cmp    ecx,eax
 804bc54:   74 0a                   je     804bc60 <phase_4+0x2ee>
 804bc56:   b8 00 00 00 00          mov    eax,0x0
 804bc5b:   e9 79 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bc60:   83 ec 0c                sub    esp,0xc
 804bc63:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc66:   e8 95 de ff ff          call   8049b00 <atof@plt>
 804bc6b:   83 c4 10                add    esp,0x10
 804bc6e:   db 7d c8                fstp   TBYTE PTR [ebp-0x38]
 804bc71:   83 ec 0c                sub    esp,0xc
 804bc74:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bc77:   e8 04 de ff ff          call   8049a80 <atoi@plt>
 804bc7c:   83 c4 10                add    esp,0x10
 804bc7f:   89 45 c4                mov    DWORD PTR [ebp-0x3c],eax
 804bc82:   db 45 c4                fild   DWORD PTR [ebp-0x3c]
 804bc85:   db 6d c8                fld    TBYTE PTR [ebp-0x38]
 804bc88:   de e1                   fsubp  st(1),st
 804bc8a:   db 2d c0 e9 08 08       fld    TBYTE PTR ds:0x808e9c0
 804bc90:   d9 c9                   fxch   st(1)
 804bc92:   df e9                   fucomip st,st(1)
 804bc94:   dd d8                   fstp   st(0)
 804bc96:   76 0a                   jbe    804bca2 <phase_4+0x330>
 804bc98:   b8 00 00 00 00          mov    eax,0x0
 804bc9d:   e9 37 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bca2:   83 ec 08                sub    esp,0x8
 804bca5:   68 be e9 08 08          push   0x808e9be
 804bcaa:   6a 00                   push   0x0
 804bcac:   e8 1f dd ff ff          call   80499d0 <strtok@plt>
 804bcb1:   83 c4 10                add    esp,0x10
 804bcb4:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bcb7:   e9 fa 00 00 00          jmp    804bdb6 <phase_4+0x444>
 804bcbc:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bcbf:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bcc2:   01 d0                   add    eax,edx
 804bcc4:   3b 45 18                cmp    eax,DWORD PTR [ebp+0x18]
 804bcc7:   7c 0a                   jl     804bcd3 <phase_4+0x361>
 804bcc9:   b8 00 00 00 00          mov    eax,0x0
 804bcce:   e9 06 01 00 00          jmp    804bdd9 <phase_4+0x467>
 804bcd3:   83 ec 0c                sub    esp,0xc
 804bcd6:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bcd9:   e8 c2 db ff ff          call   80498a0 <strlen@plt>
 804bcde:   83 c4 10                add    esp,0x10
 804bce1:   89 45 f4                mov    DWORD PTR [ebp-0xc],eax
 804bce4:   c7 45 e4 00 00 00 00    mov    DWORD PTR [ebp-0x1c],0x0
 804bceb:   eb 36                   jmp    804bd23 <phase_4+0x3b1>
 804bced:   e8 be de ff ff          call   8049bb0 <__ctype_b_loc@plt>
 804bcf2:   8b 00                   mov    eax,DWORD PTR [eax]
 804bcf4:   8b 4d e4                mov    ecx,DWORD PTR [ebp-0x1c]
 804bcf7:   8b 55 e8                mov    edx,DWORD PTR [ebp-0x18]
 804bcfa:   01 ca                   add    edx,ecx
 804bcfc:   0f b6 12                movzx  edx,BYTE PTR [edx]
 804bcff:   0f be d2                movsx  edx,dl
 804bd02:   01 d2                   add    edx,edx
 804bd04:   01 d0                   add    eax,edx
 804bd06:   0f b7 00                movzx  eax,WORD PTR [eax]
 804bd09:   0f b7 c0                movzx  eax,ax
 804bd0c:   25 00 08 00 00          and    eax,0x800
 804bd11:   85 c0                   test   eax,eax
 804bd13:   75 0a                   jne    804bd1f <phase_4+0x3ad>
 804bd15:   b8 00 00 00 00          mov    eax,0x0
 804bd1a:   e9 ba 00 00 00          jmp    804bdd9 <phase_4+0x467>
 804bd1f:   83 45 e4 01             add    DWORD PTR [ebp-0x1c],0x1
 804bd23:   8b 45 e4                mov    eax,DWORD PTR [ebp-0x1c]
 804bd26:   3b 45 f4                cmp    eax,DWORD PTR [ebp-0xc]
 804bd29:   7c c2                   jl     804bced <phase_4+0x37b>
 804bd2b:   83 ec 0c                sub    esp,0xc
 804bd2e:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd31:   e8 4a dd ff ff          call   8049a80 <atoi@plt>
 804bd36:   83 c4 10                add    esp,0x10
 804bd39:   89 c1                   mov    ecx,eax
 804bd3b:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bd3e:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bd41:   01 d0                   add    eax,edx
 804bd43:   8d 14 85 00 00 00 00    lea    edx,[eax*4+0x0]
 804bd4a:   8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
 804bd4d:   01 d0                   add    eax,edx
 804bd4f:   8b 00                   mov    eax,DWORD PTR [eax]
 804bd51:   39 c1                   cmp    ecx,eax
 804bd53:   74 07                   je     804bd5c <phase_4+0x3ea>
 804bd55:   b8 00 00 00 00          mov    eax,0x0
 804bd5a:   eb 7d                   jmp    804bdd9 <phase_4+0x467>
 804bd5c:   83 ec 0c                sub    esp,0xc
 804bd5f:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd62:   e8 99 dd ff ff          call   8049b00 <atof@plt>
 804bd67:   83 c4 10                add    esp,0x10
 804bd6a:   db 7d c8                fstp   TBYTE PTR [ebp-0x38]
 804bd6d:   83 ec 0c                sub    esp,0xc
 804bd70:   ff 75 e8                push   DWORD PTR [ebp-0x18]
 804bd73:   e8 08 dd ff ff          call   8049a80 <atoi@plt>
 804bd78:   83 c4 10                add    esp,0x10
 804bd7b:   89 45 c4                mov    DWORD PTR [ebp-0x3c],eax
 804bd7e:   db 45 c4                fild   DWORD PTR [ebp-0x3c]
 804bd81:   db 6d c8                fld    TBYTE PTR [ebp-0x38]
 804bd84:   de e1                   fsubp  st(1),st
 804bd86:   db 2d c0 e9 08 08       fld    TBYTE PTR ds:0x808e9c0
 804bd8c:   d9 c9                   fxch   st(1)
 804bd8e:   df e9                   fucomip st,st(1)
 804bd90:   dd d8                   fstp   st(0)
 804bd92:   76 07                   jbe    804bd9b <phase_4+0x429>
 804bd94:   b8 00 00 00 00          mov    eax,0x0
 804bd99:   eb 3e                   jmp    804bdd9 <phase_4+0x467>
 804bd9b:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bd9e:   01 45 ec                add    DWORD PTR [ebp-0x14],eax
 804bda1:   83 ec 08                sub    esp,0x8
 804bda4:   68 be e9 08 08          push   0x808e9be
 804bda9:   6a 00                   push   0x0
 804bdab:   e8 20 dc ff ff          call   80499d0 <strtok@plt>
 804bdb0:   83 c4 10                add    esp,0x10
 804bdb3:   89 45 e8                mov    DWORD PTR [ebp-0x18],eax
 804bdb6:   83 7d e8 00             cmp    DWORD PTR [ebp-0x18],0x0
 804bdba:   0f 85 fc fe ff ff       jne    804bcbc <phase_4+0x34a>
 804bdc0:   8b 55 ec                mov    edx,DWORD PTR [ebp-0x14]
 804bdc3:   8b 45 10                mov    eax,DWORD PTR [ebp+0x10]
 804bdc6:   01 d0                   add    eax,edx
 804bdc8:   3b 45 18                cmp    eax,DWORD PTR [ebp+0x18]
 804bdcb:   7d 07                   jge    804bdd4 <phase_4+0x462>
 804bdcd:   b8 00 00 00 00          mov    eax,0x0
 804bdd2:   eb 05                   jmp    804bdd9 <phase_4+0x467>
 804bdd4:   b8 01 00 00 00          mov    eax,0x1
 804bdd9:   c9                      leave  
 804bdda:   c3                      ret

Thank you so much for your time.

Not sure why you thought `D:1` was a good idea especially after you determined that it wants a digit first. I assume at `0x808e9be` you have `":"`. It looks like you need to pass in a bunch of numbers separated by colons, then. I further assume the result of the recursive calculation you omitted is passed in as argument at `[ebp+0x10]`. Do you get the random string printed? Because you will need to adjust your string based on that. — Jester, Nov 15 '19 at 17:35
@RikusStrydom We get these bomb lab assignments every couple of months. Use the search function and you can find dozens of others. Good luck! — fuz, Nov 15 '19 at 17:38
OMW I didn't know it was such a widely used thing. That's why I didn't even bother searching for it. I did some research and saw that it uses recursion (which I knew), but I saw that it maybe has something to do with Fibonacci. But what? I can't really figure out the conditions for it. — Rikus Strydom, Nov 15 '19 at 17:56
@RikusStrydom Well, that's yours to find out! It's supposed to be a challenge for the student. — fuz, Nov 15 '19 at 17:57
@Jester, I tried using digit:digit which worked. But it then "failed" at '0x804bc52'. I tried the input "0:5:10" to see what happens — Rikus Strydom, Nov 15 '19 at 17:58
@Jester what does lines `804bc44`, `804bc4b` and `804bc4e` do? — Rikus Strydom, Nov 15 '19 at 19:15
Multiply by 4 and add an argument which is presumably the base address for an array. So that's a lookup table. — Jester, Nov 15 '19 at 19:20
@Jester makes sense. At what index will it add the value? At just like a counter? (For example counter that counts 1, 2, 3 etc) — Rikus Strydom, Nov 15 '19 at 19:22

Reverse engineering assembly

0 Answers0