1

I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;)
I need to reverse the x86-64 (AT&T) assembly back to C (fill in the blanks). I did most of the task, except a few things I didn't understand.
Here is the assembly code (the compiler did some optimizations such as making the first function inline):

0000000000401c50 <checkPasswordAux>:
401c50: 48 8d 77 11             lea    0x11(%rdi),%rsi
401c54: 31 c0                   xor    %eax,%eax
401c56: 66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
401c5d: 00 00 00 
401c60: 0f b6 17                movzbl (%rdi),%edx
401c63: 84 d2                   test   %dl,%dl
401c65: 74 29                   je     401c90 <checkPasswordAux+0x40>
401c67: 66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)
401c6e: 00 00 
401c70: 89 d1                   mov    %edx,%ecx
401c72: 83 e1 01                and    $0x1,%ecx
401c75: 01 c8                   add    %ecx,%eax
401c77: d0 fa                   sar    %dl
401c79: 75 f5                   jne    401c70 <checkPasswordAux+0x20>
401c7b: 48 83 c7 01             add    $0x1,%rdi
401c7f: 48 39 fe                cmp    %rdi,%rsi
401c82: 75 dc                   jne    401c60 <checkPasswordAux+0x10>
401c84: b8 64 00 00 00          mov    $0x64,%eax
401c89: c3                      retq   
401c8a: 66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)
401c90: f3 c3                   repz retq 
401c92: 0f 1f 40 00             nopl   0x0(%rax)
401c96: 66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
401c9d: 00 00 00 

0000000000401ca0 <checkPassword>:
401ca0: 4c 8d 47 11             lea    0x11(%rdi),%r8
401ca4: 48 89 fe                mov    %rdi,%rsi
401ca7: 31 d2                   xor    %edx,%edx
401ca9: 0f 1f 80 00 00 00 00    nopl   0x0(%rax)
401cb0: 0f b6 06                movzbl (%rsi),%eax
401cb3: 84 c0                   test   %al,%al
401cb5: 74 29                   je     401ce0 <checkPassword+0x40>
401cb7: 66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)
401cbe: 00 00 
401cc0: 89 c1                   mov    %eax,%ecx
401cc2: 83 e1 01                and    $0x1,%ecx
401cc5: 01 ca                   add    %ecx,%edx
401cc7: d0 f8                   sar    %al
401cc9: 75 f5                   jne    401cc0 <checkPassword+0x20>
401ccb: 48 83 c6 01             add    $0x1,%rsi
401ccf: 4c 39 c6                cmp    %r8,%rsi
401cd2: 75 dc                   jne    401cb0 <checkPassword+0x10>
401cd4: 31 c0                   xor    %eax,%eax
401cd6: c3                      retq   
401cd7: 66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)
401cde: 00 00 
401ce0: 83 fa 19                cmp    $0x19,%edx
401ce3: 7f ef                   jg     401cd4 <checkPassword+0x34>
401ce5: 0f be 07                movsbl (%rdi),%eax
401ce8: 84 c0                   test   %al,%al
401cea: 74 4e                   je     401d3a <checkPassword+0x9a>
401cec: 83 e8 61                sub    $0x61,%eax
401cef: 48 98                   cltq   
401cf1: 48 83 f8 19             cmp    $0x19,%rax
401cf5: 77 dd                   ja     401cd4 <checkPassword+0x34>
401cf7: 31 d2                   xor    %edx,%edx
401cf9: eb 1b                   jmp    401d16 <checkPassword+0x76>
401cfb: 0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)
401d00: 83 e8 61                sub    $0x61,%eax
401d03: 48 98                   cltq   
401d05: 48 83 f8 19             cmp    $0x19,%rax
401d09: 77 c9                   ja     401cd4 <checkPassword+0x34>
401d0b: 48 89 c1                mov    %rax,%rcx
401d0e: 48 f7 d1                not    %rcx
401d11: 48 39 d1                cmp    %rdx,%rcx
401d14: 72 be                   jb     401cd4 <checkPassword+0x34>
401d16: 48 8d 0c 52             lea    (%rdx,%rdx,2),%rcx
401d1a: 48 83 c7 01             add    $0x1,%rdi
401d1e: 48 8d 14 8a             lea    (%rdx,%rcx,4),%rdx
401d22: 48 8d 14 50             lea    (%rax,%rdx,2),%rdx
401d26: 0f be 07                movsbl (%rdi),%eax
401d29: 84 c0                   test   %al,%al
401d2b: 75 d3                   jne    401d00 <checkPassword+0x60>
401d2d: 31 c0                   xor    %eax,%eax
401d2f: 48 39 15 0a 13 20 00    cmp    %rdx,0x20130a(%rip)        # 603040 <hash>
401d36: 0f 94 c0                sete   %al
401d39: c3                      retq   
401d3a: 31 d2                   xor    %edx,%edx
401d3c: eb ef                   jmp    401d2d <checkPassword+0x8d>
401d3e: 66 90                   xchg   %ax,%ax

And here is the C code (with the things I filled):

int checkPasswordAux(char* s) {
    int sum = __0__;
    while(__*s__) {
        char c = *s;
        if(c-'a' > 25) {
            return 100;
        }
        while(c) {
            sum += c __%2__;
            c __>>=__ 1;
        }
        s++;
    }
    return sum;
}
bool checkPassword(char* s) {
    char* copy = s;
    if(checkPasswordAux(s) > __25__) {
        return 0;
    }
    s = copy;
    unsigned long y = 0;
    while(__*s__) {
        unsigned long x = *s - __97__;
        if(x > __25__) {
            return 0;
        }
        if(y > ____) {
            return 0;
        }
        y = __x+13y__;
        s++;
    }
    return __y==0x939f103__;
}

Basically the only thing missing is the 'if' condition in the second function. I can't really find this condition in the assembly. Another thing is, in the previous questions I find that the value of the variable is 0x939f103.
Again, sorry for being a needy student, any help will be very much appreciated <3

1
  • First of all, I found a mistake, it should be "y = x + 26y". Second thing is I think the if condition is "y > ~x" - y is bigger than not x.
    – mikealexx
    Jun 9 at 8:36

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.