二进制炸弹Phase_4(功能4转换)

时间:2018-10-14 04:27:44

标签: c assembly reverse-engineering

在看了几个小时的代码后,我确定输入应该是(%d%d),第一个数字的范围是(0-12),我认为最后一个数字应该是等于+65行上的%eax。

无论哪种方式,我都不太确定函数4如何转换为C代码,也不太确定第二个数字需要等于多少。任何帮助将不胜感激。

Phase_4:

0x0000000000400f9d <+0>:     sub    $0x18,%rsp
0x0000000000400fa1 <+4>:     lea    0xc(%rsp),%rcx
0x0000000000400fa6 <+9>:     lea    0x8(%rsp),%rdx
0x0000000000400fab <+14>:    mov    $0x40244f,%esi
0x0000000000400fb0 <+19>:    mov    $0x0,%eax
0x0000000000400fb5 <+24>:    callq  0x400b00 <__isoc99_sscanf@plt>
0x0000000000400fba <+29>:    cmp    $0x2,%eax
0x0000000000400fbd <+32>:    jne    0x400fcb <phase_4+46>
0x0000000000400fbf <+34>:    mov    0xc(%rsp),%eax
0x0000000000400fc3 <+38>:    sub    $0x2,%eax
0x0000000000400fc6 <+41>:    cmp    $0x2,%eax
0x0000000000400fc9 <+44>:    jbe    0x400fd0 <phase_4+51>
0x0000000000400fcb <+46>:    callq  0x401381 <explode_bomb>
0x0000000000400fd0 <+51>:    mov    0xc(%rsp),%esi
0x0000000000400fd4 <+55>:    mov    $0x8,%edi
0x0000000000400fd9 <+60>:    callq  0x400f65 <func4>
0x0000000000400fde <+65>:    cmp    %eax,0x8(%rsp)
0x0000000000400fe2 <+69>:    jne    0x400fe9 <phase_4+76>
0x0000000000400fe4 <+71>:    add    $0x18,%rsp
0x0000000000400fe8 <+75>:    retq
0x0000000000400fe9 <+76>:    callq  0x401381 <explode_bomb>
0x0000000000400fee <+81>:    jmp    0x400fe4 <phase_4+71>

Function_4:

0x0000000000400f65 <+0>:     mov    $0x0,%eax
0x0000000000400f6a <+5>:     test   %edi,%edi
0x0000000000400f6c <+7>:     jle    0x400f9c <func4+55>
0x0000000000400f6e <+9>:     mov    %esi,%eax
0x0000000000400f70 <+11>:    cmp    $0x1,%edi
0x0000000000400f73 <+14>:    je     0x400f9c <func4+55>
0x0000000000400f75 <+16>:    push   %r12
0x0000000000400f77 <+18>:    push   %rbp
0x0000000000400f78 <+19>:    push   %rbx
0x0000000000400f79 <+20>:    mov    %esi,%r12d
0x0000000000400f7c <+23>:    mov    %edi,%ebx
0x0000000000400f7e <+25>:    lea    -0x1(%rdi),%edi
0x0000000000400f81 <+28>:    callq  0x400f65 <func4>
0x0000000000400f86 <+33>:    lea    (%rax,%r12,1),%ebp
0x0000000000400f8a <+37>:    lea    -0x2(%rbx),%edi
0x0000000000400f8d <+40>:    mov    %r12d,%esi
0x0000000000400f90 <+43>:    callq  0x400f65 <func4>
0x0000000000400f95 <+48>:    add    %ebp,%eax
0x0000000000400f97 <+50>:    pop    %rbx
0x0000000000400f98 <+51>:    pop    %rbp
0x0000000000400f99 <+52>:    pop    %r12
0x0000000000400f9b <+54>:    retq
0x0000000000400f9c <+55>:    retq 

0 个答案:

没有答案