2

So we were playing CTF , and we found this interesting RE challenge . And when we did a statical analysis to the file we found an interesting for loop .

for (var_84 = 0x0; var_84 < 0x13; var_84 = var_84 + 0x1) {
       edx = var_84;
      *(int8_t * )(var_84 + "Catch Me If You Can") = sign_extend_32( * (int8_t * )(var_84 + "Catch Me If You Can")) ^ * (ebp + (edx * 0x4 - 0xd8));


}

Can anyone explain the code above ?

3

It is byte-byte string xor in specific order. "Catch me if you can" is a string, or array of bytes.

var_84 (and edx register) is an index in it. I don't know what exactly is a stack layout and can not say with what exactly it is XORed.

In more readable C it will look like as follows:

array = &"Catch me if you can"[0];
for (var_84 = 0x0; var_84 < 0x13; var_84 = var_84 + 0x1) {
       edx = var_84;
      array[var_84] = sign_extend_32( array[var_84]) ^ * (ebp + (edx * 0x4 - 0xd8));

}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.