I am reversing some x86 from an old CTF from 2014 and am trying to understand the below code (it has been shortened drastically). I believe it is performing some sort of while or for loop through a string x number of times where x is the length of the string.
Some Basic Info:
- Intel Syntax
- Function Prototype Given:
- int main(char*);
My primary confusion lies within the end of .L3 and .L2:
I believe the end of .L3 is storing the register arithmetic in [ebp-12] and then increasing the value of [ebp-8] (I believe this is a pointer to a copy of the char* arg)
.L1
push ebp
mov ebp, esp
push ebx
sub esp, 20
mov DWORD PTR [ebp-12], 0
mov eax, DWORD PTR [ebp+8]
mov DWORD PTR [ebp-8], eax
jmp .L2
.L3
// Bunch of annoying arithmetic w/ registers
mov DWORD PTR [ebp-12], eax
add DWORD PTR [ebp-8], 1
.L2:
mov eax, DWORD PTR [ebp-8]
movzx eax, BYTE PTR [eax]
test al, al
jne .L3
add esp, 20
pop ebx
pop ebp
ret
My loose conversion of this (disregarding much of .L3) is as follows in c:
int main(char* arg)
{
int loc1 = 0;
char* str = arg;
for(i = 0; str[i] != '\0'; i++) { // <=== Pretty Sure
// .L3 Stuff w/ Assignment to loc1 // This is incorrect
}
return loc1;
}
Would someone be willing to explain the incrementation of the [ebp-8], first four lines of .L2, and confirm/deny that during the return the value of eax or loc1 as I called it will return based on the end of .L2?
movzx eax, BYTE PTR [eax]
will load one byte intoal
, and set the rest ofeax
to zero. If that byte is!= 0
, the loop continues; so once the loop exits,eax
is0
so the function returns0
.