1

I have two pieces of code, one of which is compiled by me the other of which is supplied in binary-only. The code I am compiling has added instructions pertaining to ecx. What does this code do? The below is an excerpt from the main compiled by me,

[0x08049060]> pdf @ sym.main~ecx
│           0x08049172      8d4c2404       lea ecx, [arg_4h]           ; 4
│           0x08049179      ff71fc         push dword [ecx - 4]
│           0x0804917f      51             push ecx
│           0x080491c3      8b4dfc         mov ecx, dword [local_4h]
│           0x080491c7      8d61fc         lea esp, [ecx - 4]

What's the point of this code? What are we doing with ecx?

Code is compiled with -m32 -fno-stack-protector -std=c89 -fno-PIE -no-pie -O0


Complete code here,

;-- eip:
(fcn) main 89
  main (int argc, char **argv, char **envp);
; var int local_4ch @ ebp-0x4c
; var int local_ch @ ebp-0xc
; var int local_4h @ ebp-0x4
; arg int arg_4h @ esp+0x4
; DATA XREF from entry0 (0x8049086)
0x08049172      8d4c2404       lea ecx, [arg_4h]                       ; 4
0x08049176      83e4f0         and esp, 0xfffffff0
0x08049179      ff71fc         push dword [ecx - 4]
0x0804917c      55             push ebp
0x0804917d      89e5           mov ebp, esp
0x0804917f      51             push ecx
0x08049180      83ec54         sub esp, 0x54                           ; 'T'
0x08049183      c745f4000000.  mov dword [local_ch], 0
0x0804918a      83ec0c         sub esp, 0xc
0x0804918d      8d45b4         lea eax, [local_4ch]
0x08049190      50             push eax
0x08049191      e89afeffff     call sym.imp.gets                       ; char *gets(char *s)
0x08049196      83c410         add esp, 0x10
0x08049199      8b45f4         mov eax, dword [local_ch]
0x0804919c      85c0           test eax, eax
0x0804919e      7412           je 0x80491b2
0x080491a0      83ec0c         sub esp, 0xc
0x080491a3      6808a00408     push str.you_have_changed_the__modified__variable ; 0x804a008 ; "you have changed the 'modified' variable"
0x080491a8      e893feffff     call sym.imp.puts                       ; int puts(const char *s)
0x080491ad      83c410         add esp, 0x10
0x080491b0      eb10           jmp 0x80491c2
0x080491b2      83ec0c         sub esp, 0xc
0x080491b5      6831a00408     push str.Try_again                      ; 0x804a031 ; "Try again?"
0x080491ba      e881feffff     call sym.imp.puts                       ; int puts(const char *s)
0x080491bf      83c410         add esp, 0x10
; CODE XREF from main (0x80491b0)
0x080491c2      90             nop
0x080491c3      8b4dfc         mov ecx, dword [local_4h]
0x080491c6      c9             leave
0x080491c7      8d61fc         lea esp, [ecx - 4]
0x080491ca      c3             ret
2

Browse other questions tagged or ask your own question.