-
Notifications
You must be signed in to change notification settings - Fork 124
/
extra_miles.txt
81 lines (78 loc) · 4.02 KB
/
extra_miles.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Extra miles:
1. https://github.com/wapiflapi/exrs/blob/master/reverse/r1
Hint: run the binary first. use some of your GDB Kung Fu to find the holy string.
2. Decompile this function.
Dump of assembler code for function func:
0x0000000100000ee1 <+0>: push rbp
0x0000000100000ee2 <+1>: mov rbp,rsp
0x0000000100000ee5 <+4>: push r15
0x0000000100000ee7 <+6>: push r14
0x0000000100000ee9 <+8>: push r13
0x0000000100000eeb <+10>: push r12
0x0000000100000eed <+12>: push rbx
0x0000000100000eee <+13>: push rax
0x0000000100000eef <+14>: mov r14,rsi
0x0000000100000ef2 <+17>: mov rbx,rdi
0x0000000100000ef5 <+20>: lea r13,[r14-0x1]
0x0000000100000ef9 <+24>: cmp r13,0x3ff
0x0000000100000f00 <+31>: ja 0x100000f39 <func+88>
0x0000000100000f02 <+33>: lea r12,[r14+0x1]
0x0000000100000f06 <+37>: mov rdi,r12
0x0000000100000f09 <+40>: call malloc()
0x0000000100000f0e <+45>: mov r15,rax
0x0000000100000f11 <+48>: test r15,r15
0x0000000100000f14 <+51>: je 0x100000f39 <func+88>
0x0000000100000f16 <+53>: mov rdi,r15
0x0000000100000f19 <+56>: mov rsi,r12
0x0000000100000f1c <+59>: call memset()
0x0000000100000f21 <+64>: add rbx,r13
0x0000000100000f24 <+67>: xor eax,eax
0x0000000100000f26 <+69>: mov cl,BYTE PTR [rbx]
0x0000000100000f28 <+71>: mov BYTE PTR [r15+rax*1],cl
0x0000000100000f2c <+75>: inc rax
0x0000000100000f2f <+78>: dec rbx
0x0000000100000f32 <+81>: cmp r14,rax
0x0000000100000f35 <+84>: jne 0x100000f26 <func+69>
0x0000000100000f37 <+86>: jmp 0x100000f3c <func+91>
0x0000000100000f39 <+88>: xor r15d,r15d
0x0000000100000f3c <+91>: mov rax,r15
0x0000000100000f3f <+94>: add rsp,0x8
0x0000000100000f43 <+98>: pop rbx
0x0000000100000f44 <+99>: pop r12
0x0000000100000f46 <+101>: pop r13
0x0000000100000f48 <+103>: pop r14
0x0000000100000f4a <+105>: pop r15
0x0000000100000f4c <+107>: pop rbp
0x0000000100000f4d <+108>: ret
End of assembler dump.\
3. What does this function do? Why is it important?
Dump of assembler code for function func:
0x0000000100000eaa <+0>: push rbp
0x0000000100000eab <+1>: mov rbp,rsp
0x0000000100000eae <+4>: mov ecx,esi
0x0000000100000eb0 <+6>: imul ecx,edi
0x0000000100000eb3 <+9>: xor edx,edx
0x0000000100000eb5 <+11>: mov eax,ecx
0x0000000100000eb7 <+13>: div edi
0x0000000100000eb9 <+15>: cmp eax,esi
0x0000000100000ebb <+17>: jne 0x100000ed1 <func+39>
0x0000000100000ebd <+19>: xor r8d,r8d
0x0000000100000ec0 <+22>: xor edx,edx
0x0000000100000ec2 <+24>: mov eax,ecx
0x0000000100000ec4 <+26>: div esi
0x0000000100000ec6 <+28>: cmp eax,edi
0x0000000100000ec8 <+30>: cmove r8d,ecx
0x0000000100000ecc <+34>: mov eax,r8d
0x0000000100000ecf <+37>: pop rbp
0x0000000100000ed0 <+38>: ret
0x0000000100000ed1 <+39>: xor eax,eax
0x0000000100000ed3 <+41>: pop rbp
0x0000000100000ed4 <+42>: ret
End of assembler dump.