1

I'm having a hard time figuring out whatever the hell this is doing.

mov     rax, [rbp+var_720]
mov     [rbp+var_458], rax
mov     rax, [rbp+var_458]
mov     [rbp+command_], rax
mov     rax, [rbp+something_weird_idk]
mov     [rbp+var_4D8], rax
mov     rax, [rbp+var_4D8]
mov     [rbp+var_4D0], rax
mov     rax, [rbp+var_4D0]
mov     [rbp+var_4C8], rax
mov     rax, [rbp+var_4C8]
movzx   ecx, byte ptr [rax]
and     ecx, 1               <- Breakpoint here
cmp     ecx, 0
jz      loc_100003CFE

What I want to achieve is NOT jumping to loc_1000..., so if I understand correctly the cmp instruction should return 1 (so true).

With the breakpoint there, RAX is this

__common:00000001000181C8 _command:                             
__common:00000001000181C8                                         
__common:00000001000181C8 sbb     [rcx+55h], al
__common:00000001000181CB push    rsp
__common:00000001000181CC db      48h, 45h
__common:00000001000181CC push    rsp
__common:00000001000181D0 db      49h, 43h
__common:00000001000181D0 push    r12
__common:00000001000181D4 add     [r8], r8b

Though as always, no idea what this is doing.

Can anyone shed some light on this?

Also, why does assembly move data through multiple variables? For example, before the breakpoint and after the mov rax, [rbp+something_weird_idk], it's basically moving [rbp+something..] through multiple variables without doing anything. Why is that?

1 Answer 1

1

What I want to achieve is NOT jumping to loc_1000..., so if I understand correctly the cmp instruction should return 1 (so true).

You could replace the jz instruction with nop instructions.

With the breakpoint there, RAX is this Though as always, no idea what this is doing. Can anyone shed some light on this?

This memory part is not code, but a string:

cat test.asm
BITS 64

sbb     [rcx+55h], al
push    rsp
db      48h, 45h
push    rsp
db      49h, 43h
push    r12
add     [r8], r8b

hexdump -Cv test
00000000  18 41 55 54 48 45 54 49  43 41 54 45 00 00        |.AUTHETICATE..|

Also, why does assembly move data through multiple variables? For example, before the breakpoint and after the mov rax, [rbp+something_weird_idk], it's basically moving [rbp+something..] through multiple variables without doing anything. Why is that?

This is typical from gcc when used without optimization options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.