I've just started to dip into Assembly for CTF reversing challenges, and am having a great time.
A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can help with a few basic Assembly questions - or point me to good resources.
I ran the binary provided for the challenge through Binary Ninja and identified the key function - tracing the logic within a loop is giving me problems.
For the program to return the flag, we need this check function - which looks at a user-entered string - to return 1. For the check function to return a 1, we need this loop to set EAX to 0x1.
The loop starts off fairly simply:
080486d5 sub dword [ebp-0x10 {var_14_1} {var_14}], 0x1
080486d9 mov dword [ebp-0xc {var_10_1}], 0x0
080486e0 jmp 0x804870b
var_14 is the string length of the user input. By this point in the function, we know that the string length has to be at least 20
So this seems to simply set var_14_1 to var_14-1 and var_10_1 to 0.
Then we enter the loop.
The first block of the loop reads:
0804870b mov eax, dword [ebp-0xc {var_10_1}]
0804870e cmp eax, dword [ebp-0x10 {var_14_1}]
08048711 jbe 0x80486e2
Which seems to say that if var_10_1 is less than var_14_1 continue with the loop. This next block of the loop is where I think I'm not reading the code correctly:
080486e2 mov edx, dword [ebp+0x8 {arg1}]
080486e5 mov eax, dword [ebp-0xc {var_10_1}]
080486e8 add eax, edx
080486ea movzx edx, byte [eax]
080486ed mov ecx, dword [ebp+0x8 {arg1}]
080486f0 mov eax, dword [ebp-0x10 {var_14_1}]
080486f3 add eax, ecx
080486f5 movzx eax, byte [eax]
080486f8 cmp dl, al
080486fa je 0x8048703
arg1 is the user input - at this point all the know is that it has to be at least 20 characters long, and the first 4 characters are "auqa"
We need this cmp to succeed (dl == al) for the loop to continue. Otherwise, the code exits the loop and returns EAX to 0x0 (failure). Having said that - if we know that var_10_1 is 0 and var_14_1 is at least 19 at this first pass in the loop, and we add each to arg1 - then how can DL and AL be equal? Am I misunderstanding how add eax, edx
and add eax, ecx
work?
I'm not sure where my understanding of the code is incorrect - very much appreciate any tips or pointers. Apologize if this covers basic knowledge - I'm working through these on my own.
Thank you!