2

This is a multi part program where a 'challenge token' is generated and I have to provide a response that I believe needs to be in token form as well because when I enter it the parts in without spaces or a delimiter it fails. But I've also noticed that when even though strtok is called, the registers that hold my response include the delimiter which is what I think is throwing this off when my string is compared with the code's strings. Am I supposed to find or use a certain delimiter?

Another question, In this portion rbp-0x50 is the counter as it cycles through this part 4 times. I'm not sure what sprintf does, (Any insight?) Overall it seems to be generating the string which my response should mirror into rbp-0x30. After this segment, the code goes on to show that whatever sprintf puts into RAX which ultimately ends up in qword [rbp-0x48] should be the same as what was generated in [rbp-0x30].

Disassembly :

400cd4:  mov     eax, dword [rbp-0x50]
400cd7:  movzx   eax, byte [rbp+rax-0x40]
400cdc:  movsx   eax, al
400cdf:  mov     edx, dword [rbp-0x50]
400ce2:  lea     ecx, [rdx+rdx]
400ce5:  lea     rdx, [rbp-0x30]
400ce9:  mov     ecx, ecx
400ceb:  add     rcx, rdx
400cee:  mov     edx, eax
400cf0:  mov     esi, 0x40101a  "%02X"
400cf5:  mov     rdi, rcx
400cf8:  mov     eax, 0x0
400cfd:  call    sprintf
400d02:  add     dword [rbp-0x50], 0x1
400d06:  cmp     dword [rbp-0x50], 0x4
400d0a:  jbe     0x400cd4

400d0c:  mov     esi, 0x401018
400d11:  mov     edi, 0x0
400d16:  call    strtok
400d1b:  mov     qword [rbp-0x48], rax
400d1f:  cmp     qword [rbp-0x48], 0x0
400d24:  jne     0x400d2d
Improve this question
1
  • sprintf formats a string as printf would, but it does so silently and stores the result in the first argument, which in your case looks to be [rbp-0x30].
    – h0r53
    Commented Aug 17, 2022 at 21:24

1 Answer 1

Reset to default
2

The first part takes four bytes at rbp-0x40..rbp-0x3d and hexdumps them into rbp-0x30 one byte at a time using sprintf.

The second part is unrelated. It calls strtok with NULL as first argument (rdi), which resumes an earlier tokenization and does not depend on the hexdump generated in the loop before.

Improve this answer
2
  • ok, thanks. I guess where I'm stuck is RAX is 2 until after STRTOK happens then RAX becomes 0 which gets moved into rbp-0x40 causing the program not to continue on to where '0x400d2d' is Is strtok returning the zero value? What would that mean if so?
    – 4n6fun
    Commented Aug 19, 2022 at 20:35
  • Yes, the zero in RAX is the return value of strtok. It means "no further tokens present". Your input to that code obviously needs to be longer than you currently provide. The ESI register at a call to strtok points to a string that contains the token separator chars. Note that you pass into strtok how the token you want to get now ends. This means the separator before the token that strtok should return is in ESI at the previous strtok call.
    – Michael Karcher
    Commented Aug 19, 2022 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.