0

I have a disassembled C binary that I would like to reverse engineer. It is a program that takes an input "username" string, and returns a (most-likely) unique 8-digit hex number for identification purposes. It would be really helpful for my understanding if someone could explain what some good general approaches to reverse engineering assembly manually would be or any insights into the functions themselves.

I used objdump -d to disassemble it. (this is it trimmed). Unfortunately, all I could learn from it by stepping through it with gdb was that the hash seems to be iterated (though I'm hoping it won't be a one-way function).

08048414 <main>:
 8048414:   55                      push   %ebp
 8048415:   89 e5                   mov    %esp,%ebp
 8048417:   83 e4 f0                and    $0xfffffff0,%esp
 804841a:   57                      push   %edi
 804841b:   56                      push   %esi
 804841c:   53                      push   %ebx
 804841d:   83 ec 14                sub    $0x14,%esp
 8048420:   8b 7d 08                mov    0x8(%ebp),%edi
 8048423:   8b 75 0c                mov    0xc(%ebp),%esi
 8048426:   83 ff 01                cmp    $0x1,%edi
 8048429:   7e 27                   jle    8048452 <main+0x3e>
 804842b:   bb 01 00 00 00          mov    $0x1,%ebx
 8048430:   8b 04 9e                mov    (%esi,%ebx,4),%eax
 8048433:   89 04 24                mov    %eax,(%esp)
 8048436:   e8 8a 00 00 00          call   80484c5 <gencookie>
 804843b:   89 44 24 04             mov    %eax,0x4(%esp)
 804843f:   c7 04 24 c4 85 04 08    movl   $0x80485c4,(%esp)
 8048446:   e8 f1 fe ff ff          call   804833c <printf@plt>
 804844b:   83 c3 01                add    $0x1,%ebx
 804844e:   39 df                   cmp    %ebx,%edi
 8048450:   7f de                   jg     8048430 <main+0x1c>
 8048452:   b8 00 00 00 00          mov    $0x0,%eax
 8048457:   83 c4 14                add    $0x14,%esp
 804845a:   5b                      pop    %ebx
 804845b:   5e                      pop    %esi
 804845c:   5f                      pop    %edi
 804845d:   89 ec                   mov    %ebp,%esp
 804845f:   5d                      pop    %ebp
 8048460:   c3                      ret    
 8048461:   90                      nop
 8048462:   90                      nop
 8048463:   90                      nop

08048464 <hash>:
 8048464:   55                      push   %ebp
 8048465:   89 e5                   mov    %esp,%ebp
 8048467:   8b 4d 08                mov    0x8(%ebp),%ecx
 804846a:   0f b6 11                movzbl (%ecx),%edx
 804846d:   b8 00 00 00 00          mov    $0x0,%eax
 8048472:   84 d2                   test   %dl,%dl
 8048474:   74 13                   je     8048489 <hash+0x25>
 8048476:   6b c0 67                imul   $0x67,%eax,%eax
 8048479:   0f be d2                movsbl %dl,%edx
 804847c:   8d 04 02                lea    (%edx,%eax,1),%eax
 804847f:   83 c1 01                add    $0x1,%ecx
 8048482:   0f b6 11                movzbl (%ecx),%edx
 8048485:   84 d2                   test   %dl,%dl
 8048487:   75 ed                   jne    8048476 <hash+0x12>
 8048489:   5d                      pop    %ebp
 804848a:   c3                      ret    

0804848b <check>:
 804848b:   55                      push   %ebp
 804848c:   89 e5                   mov    %esp,%ebp
 804848e:   8b 45 08                mov    0x8(%ebp),%eax
 8048491:   89 c2                   mov    %eax,%edx
 8048493:   c1 ea 1c                shr    $0x1c,%edx
 8048496:   85 d2                   test   %edx,%edx
 8048498:   74 24                   je     80484be <check+0x33>
 804849a:   3c 0a                   cmp    $0xa,%al
 804849c:   74 20                   je     80484be <check+0x33>
 804849e:   0f b6 d4                movzbl %ah,%edx
 80484a1:   83 fa 0a                cmp    $0xa,%edx
 80484a4:   74 18                   je     80484be <check+0x33>
 80484a6:   89 c2                   mov    %eax,%edx
 80484a8:   c1 ea 10                shr    $0x10,%edx
 80484ab:   80 fa 0a                cmp    $0xa,%dl
 80484ae:   74 0e                   je     80484be <check+0x33>
 80484b0:   c1 e8 18                shr    $0x18,%eax
 80484b3:   83 f8 0a                cmp    $0xa,%eax
 80484b6:   0f 95 c0                setne  %al
 80484b9:   0f b6 c0                movzbl %al,%eax
 80484bc:   eb 05                   jmp    80484c3 <check+0x38>
 80484be:   b8 00 00 00 00          mov    $0x0,%eax
 80484c3:   5d                      pop    %ebp
 80484c4:   c3                      ret    

080484c5 <gencookie>:
 80484c5:   55                      push   %ebp
 80484c6:   89 e5                   mov    %esp,%ebp
 80484c8:   53                      push   %ebx
 80484c9:   83 ec 14                sub    $0x14,%esp
 80484cc:   8b 45 08                mov    0x8(%ebp),%eax
 80484cf:   89 04 24                mov    %eax,(%esp)
 80484d2:   e8 8d ff ff ff          call   8048464 <hash>
 80484d7:   89 04 24                mov    %eax,(%esp)
 80484da:   e8 2d fe ff ff          call   804830c <srand@plt>
 80484df:   e8 68 fe ff ff          call   804834c <rand@plt>
 80484e4:   89 c3                   mov    %eax,%ebx
 80484e6:   89 04 24                mov    %eax,(%esp)
 80484e9:   e8 9d ff ff ff          call   804848b <check>
 80484ee:   85 c0                   test   %eax,%eax
 80484f0:   74 ed                   je     80484df <gencookie+0x1a>
 80484f2:   89 d8                   mov    %ebx,%eax
 80484f4:   83 c4 14                add    $0x14,%esp
 80484f7:   5b                      pop    %ebx
 80484f8:   5d                      pop    %ebp
 80484f9:   c3                      ret    
 80484fa:   90                      nop
 80484fb:   90                      nop
 80484fc:   90                      nop
 80484fd:   90                      nop
 80484fe:   90                      nop
 80484ff:   90                      nop

The executable file can be found here.

Update:

Using the ultimate disassembler (google) I found the source code (here). I found out that the unique hex digit is created by using rand() seeded with the base-103-encoded ASCII characters of the username. Calls to rand() are repeated until an 8-digit hex number is produced (and some other constraints are met).

(This update is mostly for reference)

  • What do you mean by "reverse engineering" and assembly code? Most of reverse engineering a binary consists of reading and understanding disassembled output, with million of small tools for each obscure task that might appear along the way. There is no magic bullet, just your brain vs binary code (well, disassembly) – Vitaly Osipov May 2 '16 at 4:00
  • use dejunkers to filter ur code then get what u want by an automated reverser – Abr001am May 9 '16 at 8:28
3

understanding if someone could explain what some good general approaches to reverse engineering assembly manually would be or any insights into the functions themselves.

Try opening binary EXE file with IDA and set gdb as remote debugger.IDA will analyze binary at first then determines subroutines in the assembly code.

This is a lot easier and more helpful approach you can think of.Update question with any progress you made and the specific problem you are facing so we can help you better.

  • You are 100% right, but I'd like to add that if you can't afford to buy IDA PRO (and don't want to use the old IDA free) you can also use OllyDBG to set breakpoints and debug your app. – Luca D'Amico May 3 '16 at 16:17
  • @LucaD'Amico yes eventhough the sophisticated behavior of olly it remains the best – Abr001am May 9 '16 at 8:27
  • Unfortunately I had finals the past weeks so I neglected this question. Thanks for the help, I will definitely look into these disassemblers/debuggers! – qwersjc May 14 '16 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.