[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

05/14/2009 at 09:23AM PDT, ID: 24409161 | Points: 500
[x]
Attachment Details

Reverse Engineering part of a binary bomb

Asked by mistful in Algorithms, Assembly Programming Language

I'm trying to reverse engineer part of a binary bomb to work out what the code does. Right now I'm working on diffusing level_2. I'm having some trouble figuring out what this code does:
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
08048eb0 <level_2>:
 8048eb0:       55                      push   %ebp
 8048eb1:       89 e5                   mov    %esp,%ebp
 8048eb3:       83 ec 28                sub    $0x28,%esp
 8048eb6:       8d 45 f8                lea    -0x8(%ebp),%eax
 8048eb9:       89 44 24 0c             mov    %eax,0xc(%esp)
 8048ebd:       8d 45 f4                lea    -0xc(%ebp),%eax
 8048ec0:       89 44 24 08             mov    %eax,0x8(%esp)
 8048ec4:       c7 44 24 04 02 a1 04    movl   $0x804a102,0x4(%esp)
 8048ecb:       08 
 8048ecc:       8b 45 08                mov    0x8(%ebp),%eax
 8048ecf:       89 04 24                mov    %eax,(%esp)
 8048ed2:       e8 1d fd ff ff          call   8048bf4 <sscanf@plt>
 8048ed7:       89 45 fc                mov    %eax,-0x4(%ebp)
 8048eda:       83 7d fc 01             cmpl   $0x1,-0x4(%ebp)
 8048ede:       7f 05                   jg     8048ee5 <level_2+0x35>
 8048ee0:       e8 75 0e 00 00          call   8049d5a <explode_bomb>
 8048ee5:       8b 45 f4                mov    -0xc(%ebp),%eax
 8048ee8:       89 44 24 04             mov    %eax,0x4(%esp)
 8048eec:       c7 04 24 40 bc 04 08    movl   $0x804bc40,(%esp)
 8048ef3:       e8 0c fb ff ff          call   8048a04 <strchr@plt>
 8048ef8:       89 c2                   mov    %eax,%edx
 8048efa:       b8 40 bc 04 08          mov    $0x804bc40,%eax
 8048eff:       29 c2                   sub    %eax,%edx
 8048f01:       8b 45 f8                mov    -0x8(%ebp),%eax
 8048f04:       39 c2                   cmp    %eax,%edx
 8048f06:       74 05                   je     8048f0d <level_2+0x5d>
 8048f08:       e8 4d 0e 00 00          call   8049d5a <explode_bomb>
 8048f0d:       c9                      leave  
 8048f0e:       c3                      ret
[+][-]05/14/09 10:55 AM, ID: 24387537

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05/14/09 12:28 PM, ID: 24388700

Experts Exchange has a courteous staff of administrators who help members get the most out of the website by means of administrative comments like this one.

Start your 30-day free trial to view this Administrative Comment or ask the Experts your question.

 
 
Loading Advertisement...
20090824-EE-VQP-74 - Hierarchy / EE_QW_3_20080625