-6

Can somebody tell if this MIPS assembly code uses some RSA libraries or what info is precisely extracted?

.text:00088090  # =============== S U B R O U T I N E =======================================
.text:00088090
.text:00088090
.text:00088090                 .globl _058A5
.text:00088090 _058A5:                                  # CODE XREF: _03E2D+38p
.text:00088090                                          # DATA XREF: _03E2D+2Co ...
.text:00088090
.text:00088090 var_78          = -0x78
.text:00088090 var_70          = -0x70
.text:00088090 var_68          = -0x68
.text:00088090 var_58          = -0x58
.text:00088090 var_48          = -0x48
.text:00088090 var_38          = -0x38
.text:00088090 var_28          = -0x28
.text:00088090 var_24          = -0x24
.text:00088090 var_20          = -0x20
.text:00088090 var_1C          = -0x1C
.text:00088090 var_18          = -0x18
.text:00088090 var_14          = -0x14
.text:00088090 var_10          = -0x10
.text:00088090 var_C           = -0xC
.text:00088090 var_8           = -8
.text:00088090
.text:00088090                 la      $gp, loc_BF460   # _058A5
.text:00088098                 addu    $gp, $t9
.text:0008809C                 addiu   $sp, -0x88
.text:000880A0                 sw      $gp, 0x88+var_70($sp)
.text:000880A4                 sw      $s0, 0x88+var_28($sp)
.text:000880A8                 la      $s0, 0xF0000
.text:000880AC                 nop
.text:000880B0                 addiu   $s0, (unk_F77A8 - 0xF0000)
.text:000880B4                 sw      $s6, 0x88+var_10($sp)
.text:000880B8                 sw      $s5, 0x88+var_14($sp)
.text:000880BC                 sw      $s4, 0x88+var_18($sp)
.text:000880C0                 movn    $s0, $a1, $a1
.text:000880C4                 move    $s4, $a2
.text:000880C8                 move    $s6, $a3
.text:000880CC                 move    $s5, $zero
.text:000880D0                 sw      $ra, 0x88+var_8($sp)
.text:000880D4                 sw      $gp, 0x88+var_C($sp)
.text:000880D8                 sw      $s3, 0x88+var_1C($sp)
.text:000880DC                 sw      $s2, 0x88+var_20($sp)
.text:000880E0                 sw      $s1, 0x88+var_24($sp)
.text:000880E4                 addiu   $s1, $sp, 0x88+var_58
.text:000880E8                 addiu   $s3, $sp, 0x88+var_48
.text:000880EC                 addiu   $s2, $sp, 0x88+var_38
.text:000880F0                 addiu   $a0, $sp, 0x88+var_68
.text:000880F4                 move    $a1, $s1
.text:000880F8                 move    $a2, $s3
.text:000880FC                 move    $a3, $s2
.text:00088100                 sw      $zero, 0x88+var_78($sp)
.text:00088104                 la      $t9, _03DE5
.text:00088110
.text:00088110 loc_88110:                               # DATA XREF: sub_BF3E0o
.text:00088110                 jalr    $t9 ; _03DE5
.text:00088114                 nop
.text:00088118                 lw      $gp, 0x88+var_70($sp)
.text:0008811C                 move    $a1, $s0
.text:00088120                 addiu   $a0, $sp, 0x88+var_68
.text:00088124                 beqz    $v0, loc_8815C
.text:00088128                 li      $a2, 0x50
.text:0008812C
.text:0008812C loc_8812C:                               # CODE XREF: _058A5+ECj
.text:0008812C                                          # _058A5+11Cj ...
.text:0008812C                 li      $s5, 4
.text:00088130                 move    $v0, $s5
.text:00088134
.text:00088134 loc_88134:                               # CODE XREF: _058A5+1C0j
.text:00088134                 lw      $ra, 0x88+var_8($sp)
.text:00088138                 lw      $s6, 0x88+var_10($sp)
.text:0008813C                 lw      $s5, 0x88+var_14($sp)
.text:00088140                 lw      $s4, 0x88+var_18($sp)
.text:00088144                 lw      $s3, 0x88+var_1C($sp)
.text:00088148                 lw      $s2, 0x88+var_20($sp)
.text:0008814C                 lw      $s1, 0x88+var_24($sp)
.text:00088150                 lw      $s0, 0x88+var_28($sp)
.text:00088154                 jr      $ra
.text:00088158                 addiu   $sp, 0x88
.text:0008815C  # ---------------------------------------------------------------------------
.text:0008815C
.text:0008815C loc_8815C:                               # CODE XREF: _058A5+94j
.text:0008815C                 la      $t9, _01D91
.text:00088168                 jalr    $t9 ; _01D91
.text:0008816C                 nop
.text:00088170                 lw      $gp, 0x88+var_70($sp)
.text:00088174                 move    $a1, $s4
.text:00088178                 move    $a0, $s1
.text:0008817C                 bnez    $v0, loc_8812C
.text:00088180                 li      $a2, 0x11
.text:00088184                 la      $t9, _01D91
.text:00088190                 jalr    $t9 ; _01D91
.text:00088194                 nop
.text:00088198                 lw      $gp, 0x88+var_70($sp)
.text:0008819C                 la      $a1, 0xF0000
.text:000881A0                 nop
.text:000881A4                 addiu   $a1, (unk_F77F8 - 0xF0000)
.text:000881A8                 move    $a0, $s3
.text:000881AC                 bnez    $v0, loc_8812C
.text:000881B0                 li      $a2, 0x50
.text:000881B4                 la      $t9, _01D91
.text:000881C0                 jalr    $t9 ; _01D91
.text:000881C4                 nop
.text:000881C8                 lw      $gp, 0x88+var_70($sp)
.text:000881CC                 move    $a3, $s2
.text:000881D0                 move    $a1, $s1
.text:000881D4                 addiu   $a0, $sp, 0x88+var_68
.text:000881D8                 bnez    $v0, loc_8812C
.text:000881DC                 move    $a2, $s3
.text:000881E0                 la      $t9, _058F6
.text:000881EC                 jalr    $t9 ; _058F6
.text:000881F0                 nop
.text:000881F4                 lw      $gp, 0x88+var_70($sp)
.text:000881F8                 move    $a1, $s6
.text:000881FC
.text:000881FC loc_881FC:                               # DATA XREF: sub_BF2F4o
.text:000881FC                 move    $a0, $s2
.text:00088200                 bnez    $v0, loc_8812C
.text:00088204                 li      $a2, 0x50
.text:00088208                 la      $t9, _01001
.text:00088214                 jalr    $t9 ; _01001
.text:00088218                 nop
.text:0008821C                 lw      $gp, 0x88+var_70($sp)
.text:00088220                 move    $a3, $s2
.text:00088224                 move    $a1, $s1
.text:00088228                 addiu   $a0, $sp, 0x88+var_68
.text:0008822C                 bnez    $v0, loc_8812C
.text:00088230                 move    $a2, $s3
.text:00088234                 sw      $zero, 0x88+var_78($sp)
.text:00088238                 la      $t9, _04E0F
.text:00088244                 jalr    $t9 ; _04E0F
.text:00088248                 nop
.text:0008824C                 lw      $gp, 0x88+var_70($sp)
.text:00088250                 b       loc_88134
.text:00088254                 move    $v0, $s5
.text:00088254  # End of function _058A5
.text:00088254
7
  • I've deduced there no are RSA libraries in that ASM. Dec 10, 2013 at 14:18
  • But this subroutine do something with this unk_F77A8, which is a 0x50 hex key, so maybe what it does should be in other function? someone could convert this asm to readable info for simple humans? xD
    – numind
    Dec 10, 2013 at 14:32
  • 1
  • Without seeing the entire disassembled code it's all up for interpretation. the 0x50 you are looking at is taking the immediate value and storing it into register $a2. I would recommend reading the quick tutorial MIPS ASM and possibly trying out the MARS MIPS Assembler/Simulator. At the very least it can give you a better insight into the meanings of the disassembled code instead of trying to guess. Dec 10, 2013 at 15:21
  • 1
    There's not enough context to answer your question, since this code calls other functions. Also, this site's rules state, "Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." Thus, your question is off-topic. Dec 10, 2013 at 19:38

1 Answer 1

3

Here is a C representation of the assembly (assuming I didn't mess anything up of course). Interestingly, the first argument to this function appears to be ignored:

int sub_058A5(int unused, void *unk1, void *unk2, void *unk3)
{
    int retval = 4;
    void *ptr = unk_F77A8;

    if(unk1 != NULL)
    {
        ptr = unk1;
    }

    if(sub_03DE5(var_68, var_58, var_48, var_38, 0) == 0 &&
       sub_01D91(var_68, ptr, 0x50) == 0 && 
       sub_01D91(var_58, unk2, 0x11) == 0 &&
       sub_01D91(var_48, unk_F77F8, 0x50) == 0 &&
       sub_058F6(var_68, var_58, var_48, var_38) == 0 &&
       sub_01001(var_38, unk3, 0x50) == 0)
    {
        sub_04E0F(var_68, var_58, var_48, var_38, 0);
        retval = 0;
    }

    return retval;
}

Of course, this really doesn't tell you much unless you know what those other subroutines are doing.

Not the answer you're looking for? Browse other questions tagged or ask your own question.