1

Below code is from the IDA.

This is the code before the parsing function:

movzx   eax, byte ptr [rbp+nineth_char+3]
movsx   eax, al
mov     edi, eax
call    sub_898

And this is the code of the parsing function:

push    rbp
mov     rbp, rsp
mov     eax, edi
mov     [rbp+var_14], al
movsx   eax, [rbp+var_14]
mov     [rbp+var_1], al
mov     [rbp+var_2], 250
movzx   edx, [rbp+var_1]
movzx   eax, [rbp+var_2]
add     eax, edx
nop
pop     rbp
retn

The argument of this function is the ascii value of the nineth char from the argument of the binary file. This value is added to the value from [rbp+var_2] which is 250. And this function returns the result of the adding.

This is the code after the parsing function:

mov     edx, eax
movzx   eax, [rbp+var_35] ; 101
cmp     dl, al
jz      short loc_F6

Result is compared with 101 value and when ZF flag is set the processor will jump to the next label.

The equation is: ascii_value_of_char + 250 = 101, but the ascii value of character can't be a negative number. So is my understanding of this code is good or not? If not, could you tell me what am I doing wrong?

1

As far as I understand it compares only one byte of the result (sizes of the compared al and dl parts of the corresponding registers are 8 bits). This makes your equation a bit different:

(ascii_value_of_char + 250) & 0xff = 101

Which is definitely solvable, and the ascii value of char in this case is 'k'. You can see the difference between rax, eax, dh and dl for example here.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.