Skip to main content
Reverse Engineering

Return to Question

Rollback to Revision 1
Source Link
Jongware
Jongware
  • 2.4k
  • 2
  • 17
  • 30

I have the following assembly code:

0000000000400711 <foo>:
  400711:   55                      push   rbp
  400712:   48 89 e5                mov    rbp,rsp
  400715:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi
  400719:   48 c7 45 f8 00 00 00    mov    QWORD PTR [rbp-0x8],0x0
  400720:   00
  400721:   eb 10                   jmp    400733 <foo+0x22>
  400723:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]
  400727:   48 8d 50 ff             lea    rdx,[rax-0x1]
  40072b:   48 89 55 e8             mov    QWORD PTR [rbp-0x18],rdx
  40072f:   48 01 45 f8             add    QWORD PTR [rbp-0x8],rax
  400733:   48 83 7d e8 00          cmp    QWORD PTR [rbp-0x18],0x0
  400738:   75 e9                   jne    400723 <foo+0x12>
  40073a:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]
  40073e:   5d                      pop    rbp
  40073f:   c3                      ret

I've been trying for several hours to figure out what this code does. From just trial and error with a C code to Assembly Code converter, I'm pretty sure the QWORD part comes from a char array, and the lines above it (push rbp, mov rbp, rsp) is just like a preamble. I'm really not sure how to interpret the lines that come after this. I tried storing the above code in as a file called "file.S" and then I used the following C code and terminal command to try and figure out what it does:

I have the following assembly code:

0000000000400711 <foo>:
  400711:   55                      push   rbp
  400712:   48 89 e5                mov    rbp,rsp
  400715:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi
  400719:   48 c7 45 f8 00 00 00    mov    QWORD PTR [rbp-0x8],0x0
  400720:   00
  400721:   eb 10                   jmp    400733 <foo+0x22>
  400723:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]
  400727:   48 8d 50 ff             lea    rdx,[rax-0x1]
  40072b:   48 89 55 e8             mov    QWORD PTR [rbp-0x18],rdx
  40072f:   48 01 45 f8             add    QWORD PTR [rbp-0x8],rax
  400733:   48 83 7d e8 00          cmp    QWORD PTR [rbp-0x18],0x0
  400738:   75 e9                   jne    400723 <foo+0x12>
  40073a:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]
  40073e:   5d                      pop    rbp
  40073f:   c3                      ret

I've been trying for several hours to figure out what this code does. From just trial and error with a C code to Assembly Code converter, I'm pretty sure the QWORD part comes from a char array, and the lines above it (push rbp, mov rbp, rsp) is just like a preamble. I'm really not sure how to interpret the lines that come after this. I tried storing the above code in as a file called "file.S" and then I used the following C code and terminal command to try and figure out what it does:

deleted 1430 characters in body; edited tags
Source Link
Joey
Joey
  • 165
  • 1
  • 7

I have the following assembly code:

0000000000400711 <foo>:
  400711:   55                      push   rbp
  400712:   48 89 e5                mov    rbp,rsp
  400715:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi
  400719:   48 c7 45 f8 00 00 00    mov    QWORD PTR [rbp-0x8],0x0
  400720:   00
  400721:   eb 10                   jmp    400733 <foo+0x22>
  400723:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]
  400727:   48 8d 50 ff             lea    rdx,[rax-0x1]
  40072b:   48 89 55 e8             mov    QWORD PTR [rbp-0x18],rdx
  40072f:   48 01 45 f8             add    QWORD PTR [rbp-0x8],rax
  400733:   48 83 7d e8 00          cmp    QWORD PTR [rbp-0x18],0x0
  400738:   75 e9                   jne    400723 <foo+0x12>
  40073a:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]
  40073e:   5d                      pop    rbp
  40073f:   c3                      ret

I've been trying for several hours to figure out what this code does. From just trial and error with a C code to Assembly Code converter, I'm pretty sure the QWORD part comes from a char array, and the lines above it (push rbp, mov rbp, rsp) is just like a preamble. I'm really not sure how to interpret the lines that come after this. I tried storing the above code in as a file called "file.S" and then I used the following C code and terminal command to try and figure out what it does:

I have the following assembly code:

0000000000400711 <foo>:
  400711:   55                      push   rbp
  400712:   48 89 e5                mov    rbp,rsp
  400715:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi
  400719:   48 c7 45 f8 00 00 00    mov    QWORD PTR [rbp-0x8],0x0
  400720:   00
  400721:   eb 10                   jmp    400733 <foo+0x22>
  400723:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]
  400727:   48 8d 50 ff             lea    rdx,[rax-0x1]
  40072b:   48 89 55 e8             mov    QWORD PTR [rbp-0x18],rdx
  40072f:   48 01 45 f8             add    QWORD PTR [rbp-0x8],rax
  400733:   48 83 7d e8 00          cmp    QWORD PTR [rbp-0x18],0x0
  400738:   75 e9                   jne    400723 <foo+0x12>
  40073a:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]
  40073e:   5d                      pop    rbp
  40073f:   c3                      ret

I've been trying for several hours to figure out what this code does. From just trial and error with a C code to Assembly Code converter, I'm pretty sure the QWORD part comes from a char array, and the lines above it (push rbp, mov rbp, rsp) is just like a preamble. I'm really not sure how to interpret the lines that come after this. I tried storing the above code in as a file called "file.S" and then I used the following C code and terminal command to try and figure out what it does:

Source Link
Joey
Joey
  • 165
  • 1
  • 7

Figuring out what a segment of assembly code does

I have the following assembly code:

0000000000400711 <foo>:
  400711:   55                      push   rbp
  400712:   48 89 e5                mov    rbp,rsp
  400715:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi
  400719:   48 c7 45 f8 00 00 00    mov    QWORD PTR [rbp-0x8],0x0
  400720:   00
  400721:   eb 10                   jmp    400733 <foo+0x22>
  400723:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]
  400727:   48 8d 50 ff             lea    rdx,[rax-0x1]
  40072b:   48 89 55 e8             mov    QWORD PTR [rbp-0x18],rdx
  40072f:   48 01 45 f8             add    QWORD PTR [rbp-0x8],rax
  400733:   48 83 7d e8 00          cmp    QWORD PTR [rbp-0x18],0x0
  400738:   75 e9                   jne    400723 <foo+0x12>
  40073a:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]
  40073e:   5d                      pop    rbp
  40073f:   c3                      ret

I've been trying for several hours to figure out what this code does. From just trial and error with a C code to Assembly Code converter, I'm pretty sure the QWORD part comes from a char array, and the lines above it (push rbp, mov rbp, rsp) is just like a preamble. I'm really not sure how to interpret the lines that come after this. I tried storing the above code in as a file called "file.S" and then I used the following C code and terminal command to try and figure out what it does:

#include <stdio.h>
int foo(int, int);

int main()
{
   // printf() displays the string inside quotation
   printf("%d", foo(2,2));
   return 0;
}

The terminal command I used was

gcc -g -Og -no-pie -fno-pie -m32 main.c file.S

but I just get a whole bunch of errors.

I have tried for many hours, but I'm not making any progress with deciphering this code. Any help is much appreciated. In addition, is there a fast way (e.g. a decompiler) that can do this for me in the future? I couldn't find any of those either.