how should I read this and what does it do?

.text:00400526 (main):
.text:00400526 55                               push   %rbp
.text:00400527 48 89 e5                         mov    %rsp,%rbp
.text:0040052a 48 83 ec 20                      sub    $0x20,%rsp
.text:0040052e 48 b8 4d 61 73 73 69 76 6e 69    movabs $0x696e76697373614d,%rax
.text:00400538 48 89 45 e0                      mov    %rax,-0x20(%rbp)
.text:0040053c 48 b8 79 20 6d 61 73 73 69 76    movabs $0x76697373616d2079,%rax
.text:00400546 48 89 45 e8                      mov    %rax,-0x18(%rbp)
.text:0040054a c7 45 f0 00 00 00 00             movl   $0x0,-0x10(%rbp)
.text:00400551 c7 45 fc 00 00 00 00             movl   $0x0,-0x4(%rbp)
.text:00400558 eb 22                            jmp    0x0040057c
.text:0040055a 8b 45 fc                         mov    -0x4(%rbp),%eax
.text:0040055d 48 98                            cltq   
.text:0040055f 0f b6 44 05 e0                   movzbl -0x20(%rbp,%rax,1),%eax
.text:00400564 0f be c0                         movsbl %al,%eax
.text:00400567 89 c6                            mov    %eax,%esi
.text:00400569 bf 24 06 40 00                   mov    $0x400624,%edi
.text:0040056e b8 00 00 00 00                   mov    $0x0,%eax
.text:00400573 e8 88 fe ff ff                   callq  0x00400400
.text:00400578 83 45 fc 01                      addl   $0x1,-0x4(%rbp)
.text:0040057c 8b 45 fc                         mov    -0x4(%rbp),%eax
.text:0040057f 83 f8 14                         cmp    $0x14,%eax
.text:00400582 76 d6                            jbe    0x0040055a
.text:00400584 be 14 00 00 00                   mov    $0x14,%esi
.text:00400589 bf 28 06 40 00                   mov    $0x400628,%edi
.text:0040058e b8 00 00 00 00                   mov    $0x0,%eax
.text:00400593 e8 68 fe ff ff                   callq  0x00400400
.text:00400598 b8 00 00 00 00                   mov    $0x0,%eax
.text:0040059d c9                               leaveq 
.text:0040059e c3                               retq   
.text:0040059f 90                               nop

closed as unclear what you're asking by usr2564301, 0xec, w s, perror, NirIzr Jan 26 '17 at 10:55

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What exactly are you don't understand ? It looks pretty approachable. – w s Jan 25 '17 at 20:26
  • Oh, Im new to assembly, i was wondering how should i go about reading it, im not sure if im doing it right but from what i see, it is subtracting 20 to %rsp moving $0x696e76697373614d to to %rax and subtracting 20 to rax? i started to get confused around text 00400538 – user3546656 Jan 25 '17 at 20:34
  • 1
    This is really more of a general assembly language programming question rather than a reverse engineering question. What exactly are you having trouble with. – JAL Jan 25 '17 at 21:51
  • 1
    It sounds like the problem OP is having is that he doesn't understand the assembly language, and his question "how should you read this" basically translates to "please tell me what this does". I'm not sure, but I think that's outside the remit of Reverse Engineering. – Hashim Jan 25 '17 at 23:25
  • @user3546656 have you tried using a debugger like gdb to step through and examine the instructions? – julian Jan 26 '17 at 0:20

Instead of trying to read the raw disassembly, get a decompiler reconstruct the near-perfect source for you. Since the function is small, a capable decompiler will produce satisfactory result.

Step 1

Save the disassembly above in a file called asm. Delete the first line while copying.

.text:00400526 55                               push   %rbp
.text:00400527 48 89 e5                         mov    %rsp,%rbp
.text:0040052a 48 83 ec 20                      sub    $0x20,%rsp
.text:0040052e 48 b8 4d 61 73 73 69 76 6e 69    movabs $0x696e76697373614d,%rax
.text:00400538 48 89 45 e0                      mov    %rax,-0x20(%rbp)
.text:0040053c 48 b8 79 20 6d 61 73 73 69 76    movabs $0x76697373616d2079,%rax
.text:00400546 48 89 45 e8                      mov    %rax,-0x18(%rbp)
.text:0040054a c7 45 f0 00 00 00 00             movl   $0x0,-0x10(%rbp)
.text:00400551 c7 45 fc 00 00 00 00             movl   $0x0,-0x4(%rbp)
.text:00400558 eb 22                            jmp    0x0040057c
.text:0040055a 8b 45 fc                         mov    -0x4(%rbp),%eax
.text:0040055d 48 98                            cltq   
.text:0040055f 0f b6 44 05 e0                   movzbl -0x20(%rbp,%rax,1),%eax
.text:00400564 0f be c0                         movsbl %al,%eax
.text:00400567 89 c6                            mov    %eax,%esi
.text:00400569 bf 24 06 40 00                   mov    $0x400624,%edi
.text:0040056e b8 00 00 00 00                   mov    $0x0,%eax
.text:00400573 e8 88 fe ff ff                   callq  0x00400400
.text:00400578 83 45 fc 01                      addl   $0x1,-0x4(%rbp)
.text:0040057c 8b 45 fc                         mov    -0x4(%rbp),%eax
.text:0040057f 83 f8 14                         cmp    $0x14,%eax
.text:00400582 76 d6                            jbe    0x0040055a
.text:00400584 be 14 00 00 00                   mov    $0x14,%esi
.text:00400589 bf 28 06 40 00                   mov    $0x400628,%edi
.text:0040058e b8 00 00 00 00                   mov    $0x0,%eax
.text:00400593 e8 68 fe ff ff                   callq  0x00400400
.text:00400598 b8 00 00 00 00                   mov    $0x0,%eax
.text:0040059d c9                               leaveq 
.text:0040059e c3                               retq   
.text:0040059f 90                               nop

Step 2

Run the following command to save the result in a file called asm_bytes

cat asm | cut -d ' ' -f 2- | awk -F " " '{ print $1; }' > asm_bytes

55
48 89 e5
48 83 ec 20
48 b8 4d 61 73 73 69 76 6e 69
48 89 45 e0
48 b8 79 20 6d 61 73 73 69 76
48 89 45 e8
c7 45 f0 00 00 00 00
c7 45 fc 00 00 00 00
eb 22
8b 45 fc
48 98
0f b6 44 05 e0
0f be c0
89 c6
bf 24 06 40 00
b8 00 00 00 00
e8 88 fe ff ff
83 45 fc 01
8b 45 fc
83 f8 14
76 d6
be 14 00 00 00
bf 28 06 40 00
b8 00 00 00 00
e8 68 fe ff ff
b8 00 00 00 00
c9
c3
90

Step 3

Run the following command to save the output in a file called bin.

cat asm_bytes | sed 's/ /\\x/g' | sed 's/^/\\x/' | tr -d "\n" > bin

Step 4

Load the binary file in IDA 64 bit, set processor type to MetaPC, loading offset to 0x400526.

Step 5

Fix the disassembly by pressing C to mark the code region and the use the Create Function option. This will create a function starting from the first instruction (PUSH)

Step 6

Press F5 to get the decompiled, C-like source code.

enter image description here

Not the answer you're looking for? Browse other questions tagged or ask your own question.