1

I'm working on a larger reversing project and came across this segment. I don't really understand what's going on here. There is no other way to proceed along the flow of control besides bypassing this block and jumping to 0x400d2d. Also noting that there are other locations in this program that call strtok with "reasonable" arguments, and I've bypassed those sections correctly. Would anyone share some wisdom I'm lacking? Thank you!

mov     esi, 0x401018  // delimiter argument '\'
mov     edi, 0x0       // address at 0? doesn't make sense
call    strtok
mov     qword [rbp-0x48], rax  // this is always going to return 0
cmp     qword [rbp-0x48], 0x0  
jne     0x400d2d // want to jump here, but can't
1
  • I'm pretty sure I'm working on the same problem as you were. My issue is the delimiter gets included with my response portion making my response different than the variable it checks against. Isn't strtok supposed to remove the delimiter?
    – 4n6fun
    Aug 12, 2022 at 21:41

1 Answer 1

3

This would be typical to see in use of strtok function. Example code from here

#include <string.h>
#include <stdio.h>

int main()
{
char str[80] = "This is - www.tutorialspoint.com - website";
   const char s[2] = "-";
   char *token;

   /* get the first token */
   token = strtok(str, s);

   /* walk through other tokens */
   while( token != NULL ) {
      printf( " %s\n", token );

      token = strtok(NULL, s);
   }
}

Disassembly:

.LC0:
        .string " %s\n"
main:
        push    rbp
        mov     rbp, rsp
        sub     rsp, 112
        movabs  rax, 2338328219631577172
        movabs  rdx, 8463440690376286253
        mov     QWORD PTR [rbp-96], rax
        mov     QWORD PTR [rbp-88], rdx
        movabs  rax, 8102939320206389108
        movabs  rdx, 7885630523722066287
        mov     QWORD PTR [rbp-80], rax
        mov     QWORD PTR [rbp-72], rdx
        movabs  rax, 7598525184233975072
        mov     edx, 25972
        mov     QWORD PTR [rbp-64], rax
        mov     QWORD PTR [rbp-56], rdx
        mov     QWORD PTR [rbp-48], 0
        mov     QWORD PTR [rbp-40], 0
        mov     QWORD PTR [rbp-32], 0
        mov     QWORD PTR [rbp-24], 0
        mov     WORD PTR [rbp-98], 45
        lea     rdx, [rbp-98]
        lea     rax, [rbp-96]
        mov     rsi, rdx
        mov     rdi, rax
        call    strtok
        mov     QWORD PTR [rbp-8], rax
.L3:
        cmp     QWORD PTR [rbp-8], 0
        je      .L2
        mov     rax, QWORD PTR [rbp-8]
        mov     rsi, rax
        mov     edi, OFFSET FLAT:.LC0
        mov     eax, 0
        call    printf
        lea     rax, [rbp-98]
        mov     rsi, rax
        mov     edi, 0
        call    strtok
        mov     QWORD PTR [rbp-8], rax
        jmp     .L3
.L2:
        mov     eax, 0
        leave
        ret

The token = strtok(NULL, s); line is compiled with

mov edi,0
call strtok

You can quickly check/compare different compilers and their assembly output with the website https://godbolt.org/

1
  • I see. I think I understand what's going on then. The segment I shared is looking at the next token along the line. Thanks a ton for the help!
    – TyManning
    Jan 22, 2020 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.