1

I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words. I need to write a keygen for this program. Any help would be appreciated. Thanks

0x08049530 <+0>:    lea    0x4(%esp),%ecx
   0x08049534 <+4>: and    $0xfffffff0,%esp
   0x08049537 <+7>: push   -0x4(%ecx)
   0x0804953a <+10>:    push   %ebp
   0x0804953b <+11>:    mov    %esp,%ebp
   0x0804953d <+13>:    push   %ebx
   0x0804953e <+14>:    push   %ecx
   0x0804953f <+15>:    sub    $0x40,%esp
   0x08049542 <+18>:    call   0x8049160 <__x86.get_pc_thunk.bx>
   0x08049547 <+23>:    add    $0x2ab9,%ebx
   0x0804954d <+29>:    mov    %ecx,%eax
   0x0804954f <+31>:    mov    0x4(%eax),%edx
   0x08049552 <+34>:    mov    %edx,-0x3c(%ebp)
   0x08049555 <+37>:    mov    %gs:0x14,%edx
   0x0804955c <+44>:    mov    %edx,-0xc(%ebp)
   0x0804955f <+47>:    xor    %edx,%edx
   0x08049561 <+49>:    movl   $0x65757153,-0x20(%ebp)
   0x08049568 <+56>:    movl   $0x73696d61,-0x1c(%ebp)
   0x0804956f <+63>:    movl   $0x734f2068,-0x18(%ebp)
   0x08049576 <+70>:    movl   $0x72666973,-0x14(%ebp)
   0x0804957d <+77>:    movl   $0x656761,-0x10(%ebp)
   0x08049584 <+84>:    cmpl   $0x3,(%eax)
   0x08049587 <+87>:    je     0x80495b4 <main+132>
   0x08049589 <+89>:    mov    -0x3c(%ebp),%eax
   0x0804958c <+92>:    mov    (%eax),%edx
   0x0804958e <+94>:    mov    -0x10(%ebx),%eax
   0x08049594 <+100>:   mov    (%eax),%eax
   0x08049596 <+102>:   sub    $0x4,%esp
   0x08049599 <+105>:   push   %edx
   0x0804959a <+106>:   lea    -0x1fe2(%ebx),%edx
   0x080495a0 <+112>:   push   %edx
   0x080495a1 <+113>:           push   %eax
   0x080495a2 <+114>:   call   0x80490b0 <fprintf@plt>
   0x080495a7 <+119>:   add    $0x10,%esp
   0x080495aa <+122>:   mov    $0xffffffff,%eax
   0x080495af <+127> :  jmp    0x80496d0 <main+416>
   0x080495b4 <+132>:   sub    $0x4,%esp
   0x080495b7 <+135>:   push   $0xb
   0x080495b9 <+137>:   push   $0x0
   0x080495bb <+139>:   lea    -0x36(%ebp),%eax
   0x080495be <+142>:   push   %eax
   0x080495bf <+143>:   call   0x80490c0 <memset@plt>
   0x080495c4 <+148>:   add    $0x10,%esp
   0x080495c7 <+151>:   mov    -0x3c(%ebp),%eax
   0x080495ca <+154>:   add    $0x4,%eax
   0x080495cd <+157>:   mov    (%eax),%eax
   0x080495cf <+159>:   sub    $0x4,%esp
   0x080495d2 <+162>:   push   $0xa
   0x080495d4 <+164>:   push   %eax
   0x080495d5 <+165>:   lea    -0x36(%ebp),%eax
   0x080495d8 <+168>:   push   %eax
   0x080495d9 <+169>:   call   0x80490d0 <strncpy@plt>
   0x080495de <+174>:   add    $0x10,%esp
   0x080495e1 <+177>:   sub    $0x4,%esp
   0x080495e4 <+180>:   push   $0xb
   0x080495e6 <+182>:   push   $0x0
   0x080495e8 <+184>:   lea    -0x2b(%ebp),%eax
   0x080495eb <+187>:   push   %eax
   0x080495ec <+188>:   call   0x80490c0 <memset@plt>
   0x080495f1 <+193>:           add    $0x10,%esp
   0x080495f4 <+196>:   mov    -0x3c(%ebp),%eax
   0x080495f7 <+199>:   add    $0x8,%eax
   0x080495fa <+202>:   mov    (%eax),%eax
   0x080495fc <+204>:   sub    $0x4,%esp
   0x080495ff <+207>:           push   $0xa
   0x08049601 <+209>:   push   %eax
   0x08049602 <+210>:   lea    -0x2b(%ebp),%eax
   0x08049605 <+213>:   push   %eax
   0x08049606 <+214>:   call   0x80490d0 <strncpy@plt>
   0x0804960b <+219>:   add    $0x10,%esp
   0x0804960e <+222>:   lea    -0x36(%ebp),%eax
   0x08049611 <+225>:   movzbl (%eax),%eax
   0x08049614 <+228>:   test   %al,%al
   0x08049616 <+230>:   jne    0x804963e <main+270>
   0x08049618 <+232>:   mov    -0x10(%ebx),%eax
   0x0804961e <+238>:   mov    (%eax),%eax
   0x08049620 <+240>:   push   %eax
   0x08049621 <+241>:   push   $0x10
   0x08049623 <+243>:   push   $0x1
   0x08049625 <+245>:   lea    -0x1fc7(%ebx),%eax
   0x0804962b <+251>:   push   %eax
   0x0804962c <+252>:   call   0x8049070 <fwrite@plt>
   0x08049631 <+257>:   add    $0x10,%esp
   0x08049634 <+260>:   mov    $0xffffffff,%eax
   0x08049639 <+265>:   jmp    0x80496d0 <main+416>
   0x0804963e <+270>:   call   0x8049226 <frame_dummy+6>
   0x08049643 <+275>:   test   %eax,%eax
   0x08049645 <+277>:   je     0x804966a <main+314>
   0x08049647 <+279>:   mov    -0x10(%ebx),%eax
   0x0804964d <+285>:   mov    (%eax),%eax
   0x0804964f <+287>:   push   %eax
   0x08049650 <+288>:   push   $0x8
   0x08049652 <+290>:   push   $0x1
   0x08049654 <+292>:   lea    -0x1fb6(%ebx),%eax
   0x0804965a <+298>:   push   %eax
   0x0804965b <+299>:   call   0x8049070 <fwrite@plt>
   0x08049660 <+304>:   add    $0x10,%esp
   0x08049663 <+307>:   mov    $0xffffffff,%eax
   0x08049668 <+312>:   jmp    0x80496d0 <main+416>
   0x0804966a <+314>:   sub    $0x8,%esp
   0x0804966d <+317>:   lea    -0x2b(%ebp),%eax
   0x08049670 <+320>:   push   %eax
   0x08049671 <+321>:   lea    -0x36(%ebp),%eax
   0x08049674 <+324>:   push   %eax
   0x08049675 <+325>:   call   0x80493f5 <frame_dummy+469>
   0x0804967a <+330>:   add    $0x10,%esp
   0x0804967d <+333>:   test   %eax,%eax
   0x0804967f <+335>:   jne    0x80496a4 <main+372>
   0x08049681 <+337>:   mov    -0x10(%ebx),%eax
   0x08049687 <+343>:   mov    (%eax),%eax
   0x08049689 <+345>:   push   %eax
   0x0804968a <+346>:   push   $0x16
   0x0804968c <+348>:   push   $0x1
   0x0804968e <+350>:   lea    -0x1fad(%ebx),%eax
   0x08049694 <+356>:   push   %eax
   0x08049695 <+357>:   call   0x8049070 <fwrite@plt>
   0x0804969a <+362>:   add    $0x10,%esp
   0x0804969d <+365>:   mov    $0xffffffff,%eax
   0x080496a2 <+370>:   jmp    0x80496d0 <main+416>
   0x080496a4 <+372>:   mov    0xa8(%ebx),%eax
   0x080496aa <+378>:   call   *%eax
   0x080496ac <+380>:   mov    -0x8(%ebx),%eax
   0x080496b2 <+386>:   mov    (%eax),%eax
   0x080496b4 <+388>:   sub    $0x4,%esp
   0x080496b7 <+391>:   lea    -0x20(%ebp),%edx
   0x080496ba <+394>:   push   %edx
   0x080496bb <+395>:   lea    -0x1f96(%ebx),%edx
   0x080496c1 <+401>:   push   %edx
   0x080496c2 <+402>:   push   %eax
   0x080496c3 <+403>:   call   0x80490b0 <fprintf@plt>
   0x080496c8 <+408>:   add    $0x10,%esp
   0x080496cb <+411>:   mov    $0x0,%eax
   0x080496d0 <+416>:   mov    -0xc(%ebp),%edx
   0x080496d3 <+419>:   sub    %gs:0x14,%edx
   0x080496da <+426>:   je     0x80496e1 <main+433>
   0x080496dc <+428>:   call   0x8049770 <__stack_chk_fail_local>
   0x080496e1 <+433>:   lea    -0x8(%ebp),%esp
   0x080496e4 <+436>:   pop    %ecx
   0x080496e5 <+437>:   pop    %ebx
   0x080496e6 <+438>:   pop    %ebp
   0x080496e7 <+439>:   lea    -0x4(%ecx),%esp
   0x080496ea <+442>:   ret    
3
  • 2
    If possible, don't just put the disassembly of it, please put the whole binary somewhere and give us the link to it. There might be some resources like strings, ... that is not included in this piece of dissassembly, but contained in the binary
    – raspiduino
    Aug 8, 2022 at 5:19
  • @TN_stud .. you haven't mentioned which part you're stuck on? If the problem is understanding the whole thing, then maybe start with something smaller. Compile a simple hello_world and analyse it. Have you taken any training? .. there are many good books on assembly, as well as online courses. Aug 8, 2022 at 23:20
  • 1
    the verification is in the two frame_dummy calls. It would help to know what's there. Aug 14, 2022 at 0:22

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.