0

first of all I'm new to reverse engineering so here's a noob question hahaha, I'm trying to solve a crackme and I found this set of instructions: enter image description here

Why would it move the content of eax into cd:strLength and then do in the inverse way? It doesn't make much sense to me... I would appreciate any help. Thank you all for you time.

Also, I can't find the value of offset _Z3strB5cxx11, is it because it's a relocation and its value won't be resolved until the dynamic linker resolves it during runtime or am I going crazy? Thanks for your time.

  • 1
    it is deep copy and possibly unoptimized debug build for src like int csstring = strlen(blah) if csstring == 3 so it saves len to variable cstring and then compares the variable cstring with constant and right click on the zn and look or look at start of function for offset – blabb May 10 at 10:35
  • It's not an "int", due to the jbe instruction, it's definitely "size_t" or "unsgined int". – progopis May 10 at 11:09
2

The compiler creates the code block by block, each line of the source code can correspond to one or several blocks. In the case of optimized code, sometimes several blocks of source code can turn into one.

This basic block of code can be divided into the following logical blocks

; block #1
mov edi, offset _Z3strB5cxx11
call basic_string::length() ; // sorry I'm too lazzy to type the correct function name
mov cs:strLength, eax
; block #2
mov eax, cs:strLength
cmp eax, 3
jbe loc_4011C6 ; // below-or-equal, unsigned operation, so cs:strLength is of type size_t

First block stores result of basic_string::length() in the global variable. The second block is produced from "if" statement. So the source code looks like that:

size_t strLength; // global variable
...
void someFunc() {
  ...
  strLength = str.length(); // block #1
  if (strlength <= 3) { // block #2
    // statements at the address 0x4011C6
  }
  // statements after jbe
  ...
}

Optimization flags -O1, -O2, -O3 will remove the extra move operation.

About your second question. First of all let's check the demangled name (I used https://demangler.com/). It's equal to the 'str[abi:cxx11]'. The ABI is stands for the application binary interface. It is necessary to link 2 or more binary modules. I don’t see the whole code, but by string object name I can guess you can't see it's value, cause it's external std::string. It's value should be analyzed in other module (other DLL or EXE file). So, it's not global variable only, but exported or imported value (in C++ with 'extern' keyword).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.