3

I am working through the educational "bomb.exe" file where you must defuse the bomb by entering the correct inputs. This can only be accomplished by reversing the executable file. There are no hints when the file is run.

I came across these two random jump instructions which appear to be inserted out of the flow of the program. What is the reason for their existence? Is this a byproduct of an unoptimized compilation? If they're there on purpose then which instruction points to these?

Mysterious entry points Entire Function + To/From locations

Appreciate any help!

Looking at the "flat" view it appears that they are not called from anywhere. Could these jumps be sites of malicious code injections if someone had bad intentions? It seems that if they are connected to a proper flow the injected code would go unnoticed at first glance. If I should open another thread for this question I can do that too.

Flat View

10
  • 1
    That fragment of a tree is not enough for me. Can you post the entire function? (Unless it's too long, then only post the from/to part.)
    – Jongware
    Feb 24 '18 at 5:03
  • I have included an image of the entire function with the dialogue showing all of the to/from. I'm not sure how this will help with where those two isolated JMP instructions are being called from. Feb 24 '18 at 5:39
  • was this program patched before you disassembled it? Or are you patching it currently? Feb 24 '18 at 6:12
  • 2
    There might be some indirect jumps to those instructions like jmp eax that IDA cant correctly resolve. It’s diffficult to say just by looking at an image Feb 24 '18 at 6:27
  • 1
    switch to flat mode (space bar), then you'll see better the sequence of instructions.
    – Igor Skochinsky
    Feb 24 '18 at 13:09
0

The flat view makes it obvious: the "hanging" jumps are part of the function but IDA detected that they are not reachable because the function calls preceding them (exit and bombExplodes) do not return. If you really want to see the jumps in a "proper" graph, you can clear no-returning flag from those functions, but it will be somewhat artificial since those instructions are not reachable in normal execution flow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.