I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section.

00000000000010049 <mysteryFunc>:
    10049:  f3 0f 1e fa             endbr64 
    1004d:  55                      push   rbp
    1004e:  48 89 e5                mov    rbp,rsp
    10051:  48 89 7d d8             mov    QWORD PTR [rbp-0x28],rdi     ; This is the function call with a unsigned char ptr as input s
    10055:  66 c7 45 e8 00 00       mov    WORD PTR [rbp-0x18],0x0      ; Declaring h -- unsigned short h = 0;
    1005b:  c7 45 ec 00 00 00 00    mov    DWORD PTR [rbp-0x14],0x0     ; Declaring length -- unsigned long length = 0;
    10062:  48 8b 45 d8             mov    rax,QWORD PTR [rbp-0x28]     ; Declaring a temp char pointer -- unsigned char *temp = s;
    10066:  48 89 45 f0             mov    QWORD PTR [rbp-0x10],rax
    1006a:  eb 5f                   jmp    100cb <mysteryFunc+0x82>     ; This seems to be a goto call to the end of a do-while loop

    1006c:  48 8b 45 f0             mov    rax,QWORD PTR [rbp-0x10]     
    10070:  48 89 45 f8             mov    QWORD PTR [rbp-0x8],rax

    10074:  8b 45 ec                mov    eax,DWORD PTR [rbp-0x14]     ; if(!(length & 1)) {
    10077:  83 e0 01                and    eax,0x1
    1007a:  85 c0                   test   eax,eax
    1007c:  75 22                   jne    100a0 <mysteryFunc+0x57>

I don't know what instructions in C would cause this kind of repositioning.

1006c:  48 8b 45 f0             mov    rax,QWORD PTR [rbp-0x10]     ; What's happening here?
10070:  48 89 45 f8             mov    QWORD PTR [rbp-0x8],rax

The function does some processing of a string and checks for null within a do-while loop. I get the feeling it's shifting to a next character, but a lot of the ways I can think to do something like that in C don't produce an assembly instruction like that.

The function does some things in less than conventional ways, like a goto call to the end of a do-while loop to check if the input string is null, instead of just using a regular while loop.


1 Answer 1

1006c:  48 8b 45 f0             mov    rax,QWORD PTR [rbp-0x10]

copies the value in rbp-0x10(local variable) to rax(register).

10070:  48 89 45 f8             mov    QWORD PTR [rbp-0x8],rax

copies rax to another local variable rbp-0x8. Its just creating a copy of a local variable which was a copy of the first argument to mysteryFunc.

The C-code could look something like this

int doSomething(char * s){
    char * start = s, * end = s;

sample here

  • Thanks, that was it. Was a second char pointer declared in the same line as temp and assigned in the do-while loop. Apr 25, 2022 at 8:04
  • 1
    @enkrypted87 If this is what you wanted, you can accept this answer.
    – sudhackar
    Apr 25, 2022 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.