具有两个递归函数的二进制炸弹阶段4

时间:2018-09-14 05:42:46

标签: assembly x86 reverse-engineering att

这是二进制炸弹的代码。 我已经计算出fun函数可以计算斐波那契数列。我认为极乐函数可以计算平均值,但是我不明白它使用的是什么参数。 我了解主要在做什么。我将不胜感激任何帮助。

幸福函数的汇编代码转储:

  bliss:
   0x080488b6 <+0>:     push   %ebp
   0x080488b7 <+1>:     mov    %esp,%ebp
   0x080488b9 <+3>:     push   %edi
   0x080488ba <+4>:     push   %esi
   0x080488bb <+5>:     push   %ebx
   0x080488bc <+6>:     sub    $0xc,%esp
   0x080488bf <+9>:     mov    0x8(%ebp),%ebx
   0x080488c2 <+12>:    mov    0xc(%ebp),%esi
   0x080488c5 <+15>:    mov    0x10(%ebp),%edx
   0x080488c8 <+18>:    mov    0x14(%ebp),%ecx
   0x080488cb <+21>:    mov    %ecx,%edi
   0x080488cd <+23>:    sub    %edx,%edi
   0x080488cf <+25>:    mov    %edi,%eax
   0x080488d1 <+27>:    shr    $0x1f,%eax
   0x080488d4 <+30>:    add    %edi,%eax
   0x080488d6 <+32>:    sar    %eax
   0x080488d8 <+34>:    add    %edx,%eax
   0x080488da <+36>:    cmp    %edx,%ecx
   0x080488dc <+38>:    jl     0x8048927 <bliss+113>
   0x080488de <+40>:    cmp    %edx,%ecx
   0x080488e0 <+42>:    je     0x8048901 <bliss+75>
   0x080488e2 <+44>:    cmp    (%ebx,%eax,4),%esi
   0x080488e5 <+47>:    jg     0x804890e <bliss+88>
   0x080488e7 <+49>:    push   %eax
   0x080488e8 <+50>:    push   %edx
   0x080488e9 <+51>:    push   %esi
   0x080488ea <+52>:    push   %ebx
   0x080488eb <+53>:    call   0x80488b6 <bliss>
   0x080488f0 <+58>:    add    $0x10,%esp
   0x080488f3 <+61>:    test   %eax,%eax
   0x080488f5 <+63>:    js     0x804892e <bliss+120>
   0x080488f7 <+65>:    add    %eax,%eax
   0x080488f9 <+67>:    lea    -0xc(%ebp),%esp
   0x080488fc <+70>:    pop    %ebx
   0x080488fd <+71>:    pop    %esi
   0x080488fe <+72>:    pop    %edi
   0x080488ff <+73>:    pop    %ebp
   0x08048900 <+74>:    ret
   0x08048901 <+75>:    cmp    %esi,(%ebx,%eax,4)
   0x08048904 <+78>:    setne  %al
   0x08048907 <+81>:    movzbl %al,%eax
   0x0804890a <+84>:    neg    %eax
   0x0804890c <+86>:    jmp    0x80488f9 <bliss+67>
   0x0804890e <+88>:    push   %ecx
   0x0804890f <+89>:    add    $0x1,%eax
   0x08048912 <+92>:    push   %eax
   0x08048913 <+93>:    push   %esi
   0x08048914 <+94>:    push   %ebx
   0x08048915 <+95>:    call   0x80488b6 <bliss>
   0x0804891a <+100>:   add    $0x10,%esp
   0x0804891d <+103>:   test   %eax,%eax
   0x0804891f <+105>:   js     0x8048935 <bliss+127>
   0x08048921 <+107>:   lea    0x1(%eax,%eax,1),%eax
   0x08048925 <+111>:   jmp    0x80488f9 <bliss+67>
   0x08048927 <+113>:   mov    $0xffffffff,%eax
   0x0804892c <+118>:   jmp    0x80488f9 <bliss+67>
   0x0804892e <+120>:   mov    $0xffffffff,%eax
   0x08048933 <+125>:   jmp    0x80488f9 <bliss+67>
   0x08048935 <+127>:   mov    $0xffffffff,%eax
   0x0804893a <+132>:   jmp    0x80488f9 <bliss+67>

转储用于功能接线的汇编代码:

  wiring:
   0x0804893c <+0>:     push   %ebp
   0x0804893d <+1>:     mov    %esp,%ebp
   0x0804893f <+3>:     push   %edi
   0x08048940 <+4>:     push   %esi
   0x08048941 <+5>:     push   %ebx
   0x08048942 <+6>:     sub    $0x1c,%esp
   0x08048945 <+9>:     call   0x8048570 <__x86.get_pc_thunk.bx>
   0x0804894a <+14>:    add    $0x16b6,%ebx
   0x08048950 <+20>:    mov    0x8(%ebp),%esi
   0x08048953 <+23>:    lea    -0x20(%ebp),%eax
   0x08048956 <+26>:    push   %eax
   0x08048957 <+27>:    lea    -0x1c(%ebp),%eax
   0x0804895a <+30>:    push   %eax
   0x0804895b <+31>:    lea    -0x1571(%ebx),%eax
   0x08048961 <+37>:    push   %eax
   0x08048962 <+38>:    push   %esi
   0x08048963 <+39>:    call   0x8048520 <sscanf@plt>
   0x08048968 <+44>:    add    $0x10,%esp
   0x0804896b <+47>:    cmp    $0x2,%eax
   0x0804896e <+50>:    je     0x8048975 <wiring+57>
   0x08048970 <+52>:    call   0x8048719 <explode_bomb>
   0x08048975 <+57>:    cmpl   $0x6,-0x1c(%ebp)
   0x08048979 <+61>:    jle    0x80489c4 <wiring+136>
   0x0804897b <+63>:    cmpl   $0x0,-0x20(%ebp)
   0x0804897f <+67>:    js     0x80489c4 <wiring+136>
   0x08048981 <+69>:    sub    $0xc,%esp
   0x08048984 <+72>:    pushl  -0x1c(%ebp)
   0x08048987 <+75>:    call   0x804887f <fun>
   0x0804898c <+80>:    add    $0x10,%esp
   0x0804898f <+83>:    mov    %eax,%edi
   0x08048991 <+85>:    push   $0x20
   0x08048993 <+87>:    push   $0x0
   0x08048995 <+89>:    pushl  -0x20(%ebp)
   0x08048998 <+92>:    lea    0x60(%ebx),%eax
   0x0804899e <+98>:    push   %eax
   0x0804899f <+99>:    call   0x80488b6 <bliss>
   0x080489a4 <+104>:   add    $0x10,%esp
   0x080489a7 <+107>:   cmp    %eax,%edi
   0x080489a9 <+109>:   je     0x80489b0 <wiring+116>
   0x080489ab <+111>:   call   0x8048719 <explode_bomb>
   0x080489b0 <+116>:   sub    $0xc,%esp
   0x080489b3 <+119>:   push   %esi
   0x080489b4 <+120>:   call   0x804863b <defuse>
   0x080489b9 <+125>:   add    $0x10,%esp
   0x080489bc <+128>:   lea    -0xc(%ebp),%esp
   0x080489bf <+131>:   pop    %ebx
   0x080489c0 <+132>:   pop    %esi
   0x080489c1 <+133>:   pop    %edi
   0x080489c2 <+134>:   pop    %ebp
   0x080489c3 <+135>:   ret
   0x080489c4 <+136>:   call   0x8048719 <explode_bomb>
   0x080489c9 <+141>:   jmp    0x8048981 <wiring+69>

0 个答案:

没有答案