ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are

eax ebx ecx edx esi
length of user input (min length is 3) 0 0x4020e8 0x539 0x4020e8
;-- __:
0x0040108a      678a5901       mov bl, byte [ecx + 1]
0x0040108e      01da           add edx, ebx
0x00401090      ffc1           inc ecx
0x00401092      ffc8           dec eax
0x00401094      75f4           jne loc.__
0x00401096      01d2           add edx, edx
0x00401098      89d0           mov eax, edx
0x0040109a      31d2           xor edx, edx
0x0040109c      b911000000     mov ecx, 0x11               ; 17
0x004010a1      f7f1           div ecx
0x004010a3      80c230         add dl, 0x30                ; 48
0x004010a6      678a06         mov al, byte [esi]
0x004010a9      28c2           sub dl, al
0x004010ab      84d2           test dl, dl
0x004010ad      7405           je loc.go_on

The instruction set is basically adding the ord value of each character to the decimal 1337 then doubling it and mod dividing it by 17. That's not exactly correct but it's a close enough synopsis for what I'm trying to say.

I can script out a solution for it in python easily enough.

test = 100

while True:
    pin = str(test)
    var = 1337
    var += sum([ord(c) for c in pin[1:]]) + 10
    var *= 2
    var %= 17
    var += 48
    if var == ord(pin[0]):
    test += 1

Looking at the python, you can see the little distinctions between my synopsis and the actual algorithm.

What I am hoping to find out is how to actually turn the instruction set into a best approximation of the original source code. If I were using IDA pro (just for example) it would de-compile those instructions into an actual formula. How can I reproduce that effort manually?

I'm a self learner so books or other resources on tips and tricks for decompilation would be most helpful.

EDIT 1-1-2023 The answers I've gotten thus far make me think that I am not explaining my question well. I apologize for that.

I'm trying to go from the low level assembly to the highest level, completely human-readable format of the formula.

After some thought, I came to realize that the original formula must have been very similar to
y - 48 = ((1337 + x + 10) * 2) mod 17
where y=ordinal value of first string character
and x=the sum of the ordinal values of the remaining string charaters.

That high level formula is what I am trying to get to.

  • edited in another version in my answer take a look
    – blabb
    Commented Jan 2, 2023 at 18:39

1 Answer 1


you could start with something like below and then optimize it

the flow below is not tested but should provide a starting point

the code below is trying to mimic the flow of assembly and does not correspond to the original code that was disassembled

import sys
if(len(sys.argv) <2):
    print("usage thisfile.py argument\n");
    input = sys.argv[1]
    eax = len(sys.argv[1])
    print (eax)
    counter = 0
    edx = 1337
    while (eax > counter):
        ebx = input[counter]
        edx = edx +ord(ebx)
        counter = counter + 1
    edx = edx + edx
    eax = edx
    ecx = 0x11
    rem = eax % ecx    
    print (rem)
    rem = rem + 0x30
    print("%c\n" % rem)
    secret = input[0]
    rem = rem - ord(secret)
    if (rem == 0):
        print("input is correct %c\n" % rem)
        print("wrong input")

execution and result below

:\>mandec.py 1009
1009  arg given
4     length of arg  
1     arg[0]
1386  arg[0]+1337
0     arg[1]
1434  arg[1]+arg[0]+1337
3078   doubled
1      mod = 3078-(int(3078/17)*17)
49     mod + 0x30
1      chr(49) == '1' 

input is correct

this is an optimised version but it may still not be the original code

import sys
if(len(sys.argv) <2):
    sys.exit("usage thisfile.py argument\n");    
input = sys.argv[1]
for i in input:
    j = j+ord(i)
if((str(j*2%17)) == input[0]):

or may be

input = ["1009","1018","1036","1045","1054","1899"]
    for i in input[k]:
        j = j+ord(i)
    print((str(j*2%17)) == input[k][0])

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.