-2

Possible Duplicate:
Decoding and understanding assembly code

I am a beginner with c and assembly code, we have an "bomb" assignment (written in c)which calls methods that require certain passwords, but the code is not visible and I need to determine the correct password by looking at the assembly code.

The code indicates the password for this method is 6 numbers, which is passed as "input" to method puzzle_1 (I am trying to avoid triggering ).

I can't understanding assembly code.

What is the answer to this question?

I think this puzzle_1's keyword is array.

08048db4 <puzzle_1>:
8048db4:        push   %ebp
8048db5:        mov    %esp,%ebp
8048db7:        sub    $0x38,%esp
8048dba:        lea    -0x24(%ebp),%eax
8048dbd:        mov    %eax,0x4(%esp)
8048dc1:        mov    0x8(%ebp),%eax
8048dc4:        mov    %eax,(%esp)
8048dc7:        call   804897e <read_six_numbers>
8048dcc:        movl   $0x1,-0xc(%ebp)
8048dd3:        jmp    8048df9 <puzzle_1+0x45>
8048dd5:        mov    -0xc(%ebp),%eax
8048dd8:        mov    -0x24(%ebp,%eax,4),%eax
8048ddc:        mov    -0xc(%ebp),%edx
8048ddf:         sub    $0x1,%edx
8048de2:        mov    -0x24(%ebp,%edx,4),%edx
8048de6:        add    $0xbf,%edx
8048dec:        cmp    %edx,%eax
8048dee:        je     8048df5 <puzzle_1+0x41>
8048df0:         call   8048d93 <denied_nextstep>
8048df5:         addl   $0x1,-0xc(%ebp)
8048df9:         cmpl   $0x5,-0xc(%ebp)
8048dfd:         jle    8048dd5 <puzzle_1+0x21>
8048dff:          call   8048d73 <allow_nextstep>
8048e04:        leave  
8048e05:        ret
Community
  • 1
  • 1
이병운
  • 11
  • 1
  • 2

2 Answers2

2

You need to learn assembly. A quick primer so you can discover the answer on your own is to step through the instructions one by one with a table that maps the mnemonic to its purpose, a table for the different addressing modes, a calculator for mapping hexadecimal to decimal if you can't do it in your head, and a good ol' internet connection for doing some research when you don't understand something.

For example, here is the first few instructions...

; Push the value in %ebp register onto stack
8048db4:        push   %ebp

; Copy the value from %esp register into %ebp register
8048db5:        mov    %esp,%ebp

; Subtract 0x38 from %esp register
8048db7:        sub    $0x38,%esp

; Wasn't sure about this one, so I looked it up
; (Looking up things you're not sure of is a 
;  good way to learn about those things.)
; http://stackoverflow.com/q/1658294/31671
8048dba:        lea    -0x24(%ebp),%eax
alex
  • 479,566
  • 201
  • 878
  • 984
2

There are about three categories to understand here:

1) computer architecture:

  • register architecture / Instruction Set Architecture
    • arithmetic (such as a+b)
    • bitwise logical such as a OR b
    • conditions (such as a == b or a < b ) with different flags for signed & unsigned
      • cmp %edx,%eax
    • jumping
      • unconditional: jmp
      • conditional: je; jle etc. -- related to condition codes or flags or Status Register
      • subroutines: call;
    • memory architecture
    • different kinds of addressing modes
      • immediate sub $0x38,%esp
    • memory address calculation lea -0x24(%ebp),%eax
    • CISC type: can you 'add' directly to a memory address addl $0x1,-0xc(%ebp)
    • RISC type - READ / MODIFY / WRITE back

2) syntax of the language

  • instruction src, dst vs. instr dst, src
  • encoding of labels, comments, assembler directives, decimal and hexadecimal numbers

3) Concept of local stack frame, local variables and pointers

  • push ebp; mov esp, ebp;
  • calling conventions used in this particular example (global register, general purpose registers, or stack (frame)
  • items not fitting to registers are typically passed with pointers

The best way to learn this would be using a instruction level debugger showing memory & register contents and optimally highlighting changes between each instruction. And of course reading the Instruction Set Architecture manual and Application Binary Interface specification.

Good luck!

Aki Suihkonen
  • 19,144
  • 1
  • 36
  • 57