Login
Immutable PageDiscussionInfoAttachments
attachment:guesskey.asm of ytoku/CTF/Writeup/AdventCalendarCTF2014/2014-12-19

MMA

Attachment 'guesskey.asm'

Download

   1 guesskey:     ファイル形式 elf32-i386
   2 
   3 
   4 セクション .init の逆アセンブル:
   5 
   6 080482b4 <.init>:	# 080482b4="S"...;
   7  80482b4:	53                   	push   %ebx
   8  80482b5:	83 ec 08             	sub    $0x8,%esp
   9  80482b8:	e8 93 00 00 00       	call   8048350 <_start+0x30>
  10  80482bd:	81 c3 43 1d 00 00    	add    $0x1d43,%ebx
  11  80482c3:	8b 83 fc ff ff ff    	mov    -0x4(%ebx),%eax
  12  80482c9:	85 c0                	test   %eax,%eax
  13  80482cb:	74 05                	je     80482d2 <.init+0x1e>
  14  80482cd:	e8 2e 00 00 00       	call   8048300 <__gmon_start__@plt>
  15  80482d2:	83 c4 08             	add    $0x8,%esp
  16  80482d5:	5b                   	pop    %ebx
  17  80482d6:	c3                   	ret    
  18 
  19 セクション .plt の逆アセンブル:
  20 
  21 080482e0 <printf@plt-0x10>:
  22  80482e0:	ff 35 04 a0 04 08    	pushl  0x804a004
  23  80482e6:	ff 25 08 a0 04 08    	jmp    *0x804a008
  24  80482ec:	00 00                	add    %al,(%eax)
  25 	...
  26 
  27 080482f0 <printf@plt>:
  28  80482f0:	ff 25 0c a0 04 08    	jmp    *0x804a00c
  29  80482f6:	68 00 00 00 00       	push   $0x0
  30  80482fb:	e9 e0 ff ff ff       	jmp    80482e0 <printf@plt-0x10>
  31 
  32 08048300 <__gmon_start__@plt>:
  33  8048300:	ff 25 10 a0 04 08    	jmp    *0x804a010
  34  8048306:	68 08 00 00 00       	push   $0x8
  35  804830b:	e9 d0 ff ff ff       	jmp    80482e0 <printf@plt-0x10>
  36 
  37 08048310 <__libc_start_main@plt>:
  38  8048310:	ff 25 14 a0 04 08    	jmp    *0x804a014
  39  8048316:	68 10 00 00 00       	push   $0x10
  40  804831b:	e9 c0 ff ff ff       	jmp    80482e0 <printf@plt-0x10>
  41 
  42 セクション .text の逆アセンブル:
  43 
  44 08048320 <_start>:
  45  8048320:	31 ed                	xor    %ebp,%ebp
  46  8048322:	5e                   	pop    %esi
  47  8048323:	89 e1                	mov    %esp,%ecx
  48  8048325:	83 e4 f0             	and    $0xfffffff0,%esp
  49  8048328:	50                   	push   %eax
  50  8048329:	54                   	push   %esp
  51  804832a:	52                   	push   %edx
  52  804832b:	68 20 87 04 08       	push   $0x8048720
  53  8048330:	68 b0 86 04 08       	push   $0x80486b0	# 80486b0="UW1"...;
  54  8048335:	51                   	push   %ecx
  55  8048336:	56                   	push   %esi
  56  8048337:	68 68 85 04 08       	push   $0x8048568	# 8048568="U"...;
  57  804833c:	e8 cf ff ff ff       	call   8048310 <__libc_start_main@plt>
  58  8048341:	f4                   	hlt    
  59  8048342:	66 90                	xchg   %ax,%ax
  60  8048344:	66 90                	xchg   %ax,%ax
  61  8048346:	66 90                	xchg   %ax,%ax
  62  8048348:	66 90                	xchg   %ax,%ax
  63  804834a:	66 90                	xchg   %ax,%ax
  64  804834c:	66 90                	xchg   %ax,%ax
  65  804834e:	66 90                	xchg   %ax,%ax
  66 
  67  8048350:	8b 1c 24             	mov    (%esp),%ebx
  68  8048353:	c3                   	ret    
  69  8048354:	66 90                	xchg   %ax,%ax
  70  8048356:	66 90                	xchg   %ax,%ax
  71  8048358:	66 90                	xchg   %ax,%ax
  72  804835a:	66 90                	xchg   %ax,%ax
  73  804835c:	66 90                	xchg   %ax,%ax
  74  804835e:	66 90                	xchg   %ax,%ax
  75 
  76 08048360 <deregister_tm_clones>:
  77  8048360:	b8 77 a0 04 08       	mov    $0x804a077,%eax
  78  8048365:	2d 74 a0 04 08       	sub    $0x804a074,%eax
  79  804836a:	83 f8 06             	cmp    $0x6,%eax
  80  804836d:	77 01                	ja     8048370 <deregister_tm_clones+0x10>
  81  804836f:	c3                   	ret    
  82  8048370:	b8 00 00 00 00       	mov    $0x0,%eax
  83  8048375:	85 c0                	test   %eax,%eax
  84  8048377:	74 f6                	je     804836f <deregister_tm_clones+0xf>
  85  8048379:	55                   	push   %ebp
  86  804837a:	89 e5                	mov    %esp,%ebp
  87  804837c:	83 ec 18             	sub    $0x18,%esp
  88  804837f:	c7 04 24 74 a0 04 08 	movl   $0x804a074,(%esp)
  89  8048386:	ff d0                	call   *%eax
  90  8048388:	c9                   	leave  
  91  8048389:	c3                   	ret    
  92  804838a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  93 
  94 08048390 <register_tm_clones>:
  95  8048390:	b8 74 a0 04 08       	mov    $0x804a074,%eax
  96  8048395:	2d 74 a0 04 08       	sub    $0x804a074,%eax
  97  804839a:	c1 f8 02             	sar    $0x2,%eax
  98  804839d:	89 c2                	mov    %eax,%edx
  99  804839f:	c1 ea 1f             	shr    $0x1f,%edx
 100  80483a2:	01 d0                	add    %edx,%eax
 101  80483a4:	d1 f8                	sar    %eax
 102  80483a6:	75 01                	jne    80483a9 <register_tm_clones+0x19>
 103  80483a8:	c3                   	ret    
 104  80483a9:	ba 00 00 00 00       	mov    $0x0,%edx
 105  80483ae:	85 d2                	test   %edx,%edx
 106  80483b0:	74 f6                	je     80483a8 <register_tm_clones+0x18>
 107  80483b2:	55                   	push   %ebp
 108  80483b3:	89 e5                	mov    %esp,%ebp
 109  80483b5:	83 ec 18             	sub    $0x18,%esp
 110  80483b8:	89 44 24 04          	mov    %eax,0x4(%esp)
 111  80483bc:	c7 04 24 74 a0 04 08 	movl   $0x804a074,(%esp)
 112  80483c3:	ff d2                	call   *%edx
 113  80483c5:	c9                   	leave  
 114  80483c6:	c3                   	ret    
 115  80483c7:	89 f6                	mov    %esi,%esi
 116  80483c9:	8d bc 27 00 00 00 00 	lea    0x0(%edi,%eiz,1),%edi
 117 
 118 080483d0 <__do_global_dtors_aux>:
 119  80483d0:	80 3d 80 a0 04 08 00 	cmpb   $0x0,0x804a080
 120  80483d7:	75 13                	jne    80483ec <__do_global_dtors_aux+0x1c>
 121  80483d9:	55                   	push   %ebp
 122  80483da:	89 e5                	mov    %esp,%ebp
 123  80483dc:	83 ec 08             	sub    $0x8,%esp
 124  80483df:	e8 7c ff ff ff       	call   8048360 <deregister_tm_clones>
 125  80483e4:	c6 05 80 a0 04 08 01 	movb   $0x1,0x804a080
 126  80483eb:	c9                   	leave  
 127  80483ec:	f3 c3                	repz ret 
 128  80483ee:	66 90                	xchg   %ax,%ax
 129 
 130 080483f0 <frame_dummy>:
 131  80483f0:	a1 10 9f 04 08       	mov    0x8049f10,%eax
 132  80483f5:	85 c0                	test   %eax,%eax
 133  80483f7:	74 1f                	je     8048418 <frame_dummy+0x28>
 134  80483f9:	b8 00 00 00 00       	mov    $0x0,%eax
 135  80483fe:	85 c0                	test   %eax,%eax
 136  8048400:	74 16                	je     8048418 <frame_dummy+0x28>
 137  8048402:	55                   	push   %ebp
 138  8048403:	89 e5                	mov    %esp,%ebp
 139  8048405:	83 ec 18             	sub    $0x18,%esp
 140  8048408:	c7 04 24 10 9f 04 08 	movl   $0x8049f10,(%esp)
 141  804840f:	ff d0                	call   *%eax
 142  8048411:	c9                   	leave  
 143  8048412:	e9 79 ff ff ff       	jmp    8048390 <register_tm_clones>
 144  8048417:	90                   	nop
 145  8048418:	e9 73 ff ff ff       	jmp    8048390 <register_tm_clones>
 146 
 147 0804841d <generate_table>:
 148  804841d:	55                   	push   %ebp
 149  804841e:	89 e5                	mov    %esp,%ebp
 150  8048420:	56                   	push   %esi
 151  8048421:	53                   	push   %ebx
 152 ;;  while (g804a4a0 <= 0xfe) {
 153  8048422:	e9 ad 00 00 00       	jmp    80484d4 <generate_table+0xb7>
 154 ;;      if (g804a0a0[g804a4a0] == 0) {
 155  8048427:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 156  804842c:	8b 04 85 a0 a0 04 08 	mov    0x804a0a0(,%eax,4),%eax
 157  8048433:	85 c0                	test   %eax,%eax
 158  8048435:	75 14                	jne    804844b <generate_table+0x2e>
 159 ;;          g804a0a0[g804a4a0] = g804a070;
 160  8048437:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 161  804843c:	8b 15 70 a0 04 08    	mov    0x804a070,%edx
 162  8048442:	89 14 85 a0 a0 04 08 	mov    %edx,0x804a0a0(,%eax,4)
 163  8048449:	eb 3a                	jmp    8048485 <generate_table+0x68>
 164 ;;      } else if ( ((g804a4a0 + 1) & 2) != 0 ) {
 165  804844b:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 166  8048450:	83 c0 01             	add    $0x1,%eax
 167  8048453:	83 e0 02             	and    $0x2,%eax
 168  8048456:	85 c0                	test   %eax,%eax
 169  8048458:	74 2b                	je     8048485 <generate_table+0x68>
 170 ;;          g804a0a0[g804a4a0] += g804a0a0[g804a4a0 - 2];
 171  804845a:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 172  804845f:	8b 15 a0 a4 04 08    	mov    0x804a4a0,%edx
 173  8048465:	8b 0c 95 a0 a0 04 08 	mov    0x804a0a0(,%edx,4),%ecx
 174  804846c:	8b 15 a0 a4 04 08    	mov    0x804a4a0,%edx
 175  8048472:	83 ea 02             	sub    $0x2,%edx
 176  8048475:	8b 14 95 a0 a0 04 08 	mov    0x804a0a0(,%edx,4),%edx
 177  804847c:	01 ca                	add    %ecx,%edx
 178  804847e:	89 14 85 a0 a0 04 08 	mov    %edx,0x804a0a0(,%eax,4)
 179 ;;      }
 180 ;;      ecx = g804a4a0 + 1;
 181  8048485:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 182  804848a:	8d 48 01             	lea    0x1(%eax),%ecx
 183 ;;      ebx = 2 * g804a4a0 * g804a0a0[g804a4a0];
 184  804848d:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 185  8048492:	8b 04 85 a0 a0 04 08 	mov    0x804a0a0(,%eax,4),%eax
 186  8048499:	8b 15 a0 a4 04 08    	mov    0x804a4a0,%edx
 187  804849f:	01 d2                	add    %edx,%edx
 188  80484a1:	0f af c2             	imul   %edx,%eax
 189  80484a4:	89 c3                	mov    %eax,%ebx
 190 ;;      g804a0a0[ecx] = g804a0a0[g804a4a0] / (g804a4a0 + 1) + ebx;
 191  80484a6:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 192  80484ab:	8b 04 85 a0 a0 04 08 	mov    0x804a0a0(,%eax,4),%eax
 193  80484b2:	8b 15 a0 a4 04 08    	mov    0x804a4a0,%edx
 194  80484b8:	8d 72 01             	lea    0x1(%edx),%esi
 195  80484bb:	99                   	cltd   
 196  80484bc:	f7 fe                	idiv   %esi
 197  80484be:	01 d8                	add    %ebx,%eax
 198  80484c0:	89 04 8d a0 a0 04 08 	mov    %eax,0x804a0a0(,%ecx,4)
 199 ;;      g804a4a0++;
 200  80484c7:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 201  80484cc:	83 c0 01             	add    $0x1,%eax
 202  80484cf:	a3 a0 a4 04 08       	mov    %eax,0x804a4a0
 203 ;;  }
 204  80484d4:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 205  80484d9:	3d fe 00 00 00       	cmp    $0xfe,%eax
 206  80484de:	0f 8e 43 ff ff ff    	jle    8048427 <generate_table+0xa>
 207  80484e4:	5b                   	pop    %ebx
 208  80484e5:	5e                   	pop    %esi
 209  80484e6:	5d                   	pop    %ebp
 210  80484e7:	c3                   	ret    
 211 
 212 080484e8 <get_nextkey>:
 213 ;;  int get_nextkey() {
 214 ;;      return g804a0a0[g804a4a0++];
 215 ;;  }
 216  80484e8:	55                   	push   %ebp
 217  80484e9:	89 e5                	mov    %esp,%ebp
 218  80484eb:	83 ec 10             	sub    $0x10,%esp
 219  80484ee:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 220  80484f3:	8b 04 85 a0 a0 04 08 	mov    0x804a0a0(,%eax,4),%eax
 221  80484fa:	89 45 fc             	mov    %eax,-0x4(%ebp)
 222  80484fd:	a1 a0 a4 04 08       	mov    0x804a4a0,%eax
 223  8048502:	83 c0 01             	add    $0x1,%eax
 224  8048505:	a3 a0 a4 04 08       	mov    %eax,0x804a4a0
 225  804850a:	8b 45 fc             	mov    -0x4(%ebp),%eax
 226  804850d:	c9                   	leave  
 227  804850e:	c3                   	ret    
 228 
 229 0804850f <is_12>:
 230  804850f:	55                   	push   %ebp
 231  8048510:	89 e5                	mov    %esp,%ebp
 232  8048512:	83 ec 18             	sub    $0x18,%esp
 233 ;;  double v18 = arg1;
 234  8048515:	8b 45 08             	mov    0x8(%ebp),%eax
 235  8048518:	89 45 e8             	mov    %eax,-0x18(%ebp)
 236  804851b:	8b 45 0c             	mov    0xc(%ebp),%eax
 237  804851e:	89 45 ec             	mov    %eax,-0x14(%ebp)
 238 ;;  
 239  8048521:	c7 45 fc 00 00 00 00 	movl   $0x0,-0x4(%ebp)
 240 ;;  v18 /= 65536.0;  // 0x8048758: 65536.0
 241  8048528:	dd 45 e8             	fldl   -0x18(%ebp)
 242  804852b:	dd 05 58 87 04 08    	fldl   0x8048758
 243  8048531:	de f9                	fdivrp %st,%st(1)
 244  8048533:	dd 5d e8             	fstpl  -0x18(%ebp)
 245 ;;  if (v18 == 65536.0) return 0;
 246  8048536:	dd 45 e8             	fldl   -0x18(%ebp)
 247  8048539:	dd 05 60 87 04 08    	fldl   0x8048760
 248  804853f:	df e9                	fucomip %st(1),%st
 249  8048541:	dd d8                	fstp   %st(0)
 250  8048543:	7a 16                	jp     804855b <is_12+0x4c>
 251  8048545:	dd 45 e8             	fldl   -0x18(%ebp)
 252  8048548:	dd 05 60 87 04 08    	fldl   0x8048760
 253  804854e:	df e9                	fucomip %st(1),%st
 254  8048550:	dd d8                	fstp   %st(0)
 255  8048552:	74 02                	je     8048556 <is_12+0x47>
 256  8048554:	eb 05                	jmp    804855b <is_12+0x4c>
 257  8048556:	8b 45 fc             	mov    -0x4(%ebp),%eax
 258  8048559:	eb 0b                	jmp    8048566 <is_12+0x57>
 259 ;;  return 1;
 260  804855b:	90                   	nop
 261  804855c:	83 7d fc 00          	cmpl   $0x0,-0x4(%ebp)
 262  8048560:	0f 94 c0             	sete   %al
 263  8048563:	0f b6 c0             	movzbl %al,%eax
 264  8048566:	c9                   	leave  
 265  8048567:	c3                   	ret    
 266 
 267 08048568 <main>:
 268  8048568:	55                   	push   %ebp
 269  8048569:	89 e5                	mov    %esp,%ebp
 270  804856b:	57                   	push   %edi
 271  804856c:	83 e4 f0             	and    $0xfffffff0,%esp
 272  804856f:	83 ec 30             	sub    $0x30,%esp
 273  8048572:	83 7d 08 02          	cmpl   $0x2,0x8(%ebp)	; argc
 274  8048576:	74 05                	je     804857d <main+0x15>
 275  8048578:	e9 28 01 00 00       	jmp    80486a5 <main+0x13d>	; return 1;
 276 
 277 ;; v20 = strlen(argv[1]);
 278  804857d:	8b 45 0c             	mov    0xc(%ebp),%eax   ; argv
 279  8048580:	83 c0 04             	add    $0x4,%eax
 280  8048583:	8b 10                	mov    (%eax),%edx
 281  8048585:	b8 00 00 00 00       	mov    $0x0,%eax
 282  804858a:	b9 ff ff ff ff       	mov    $0xffffffff,%ecx
 283  804858f:	89 d7                	mov    %edx,%edi
 284  8048591:	f2 ae                	repnz scas %es:(%edi),%al
 285  8048593:	89 fa                	mov    %edi,%edx
 286  8048595:	89 4c 24 20          	mov    %ecx,0x20(%esp)
 287  8048599:	89 54 24 1c          	mov    %edx,0x1c(%esp)
 288  804859d:	b8 fe ff ff ff       	mov    $0xfffffffe,%eax
 289  80485a2:	2b 44 24 20          	sub    0x20(%esp),%eax
 290  80485a6:	89 44 24 20          	mov    %eax,0x20(%esp)
 291 ;;  uint_64 v8 = v20;
 292  80485aa:	8b 44 24 20          	mov    0x20(%esp),%eax
 293  80485ae:	ba 00 00 00 00       	mov    $0x0,%edx
 294  80485b3:	89 44 24 08          	mov    %eax,0x8(%esp)
 295  80485b7:	89 54 24 0c          	mov    %edx,0xc(%esp)
 296 ;;;;  push v8 to FPU register stack;
 297 ;;;;  pop to v0 from FPU register stack
 298 ;;  if (is_12((double)v8)) return 1;
 299  80485bb:	df 6c 24 08          	fildll 0x8(%esp)
 300  80485bf:	dd 1c 24             	fstpl  (%esp)
 301  80485c2:	e8 48 ff ff ff       	call   804850f <is_12>
 302  80485c7:	83 f8 01             	cmp    $0x1,%eax
 303  80485ca:	75 05                	jne    80485d1 <main+0x69>
 304  80485cc:	e9 d4 00 00 00       	jmp    80486a5 <main+0x13d> ; return 1;
 305 
 306 ;;  generate_table();
 307  80485d1:	e8 47 fe ff ff       	call   804841d <generate_table>
 308 
 309 ;;  for (int i = 0; i < 32; i++) {
 310  80485d6:	c7 44 24 2c 00 00 00 	movl   $0x0,0x2c(%esp)
 311  80485dd:	00 
 312  80485de:	e9 95 00 00 00       	jmp    8048678 <main+0x110>
 313 ;;      char c = argv[1][i];
 314  80485e3:	8b 45 0c             	mov    0xc(%ebp),%eax
 315  80485e6:	83 c0 04             	add    $0x4,%eax
 316  80485e9:	8b 10                	mov    (%eax),%edx
 317  80485eb:	8b 44 24 2c          	mov    0x2c(%esp),%eax
 318  80485ef:	01 d0                	add    %edx,%eax
 319  80485f1:	0f b6 00             	movzbl (%eax),%eax
 320  80485f4:	88 44 24 1b          	mov    %al,0x1b(%esp)
 321 ;;      g804a4a0 = c + i;
 322  80485f8:	0f be 54 24 1b       	movsbl 0x1b(%esp),%edx
 323  80485fd:	8b 44 24 2c          	mov    0x2c(%esp),%eax
 324  8048601:	01 d0                	add    %edx,%eax
 325  8048603:	a3 a0 a4 04 08       	mov    %eax,0x804a4a0
 326 ;;      if (!isalnum(c)) return 1;
 327  8048608:	80 7c 24 1b 2f       	cmpb   $0x2f,0x1b(%esp)
 328  804860d:	7e 09                	jle    8048618 <main+0xb0>
 329  804860f:	80 7c 24 1b 39       	cmpb   $0x39,0x1b(%esp)
 330  8048614:	7f 02                	jg     8048618 <main+0xb0>
 331  8048616:	eb 1e                	jmp    8048636 <main+0xce>
 332  8048618:	80 7c 24 1b 40       	cmpb   $0x40,0x1b(%esp)
 333  804861d:	7e 09                	jle    8048628 <main+0xc0>
 334  804861f:	80 7c 24 1b 5a       	cmpb   $0x5a,0x1b(%esp)
 335  8048624:	7f 02                	jg     8048628 <main+0xc0>
 336  8048626:	eb 0e                	jmp    8048636 <main+0xce>
 337  8048628:	80 7c 24 1b 60       	cmpb   $0x60,0x1b(%esp)
 338  804862d:	7e 76                	jle    80486a5 <main+0x13d>
 339  804862f:	80 7c 24 1b 7a       	cmpb   $0x7a,0x1b(%esp)
 340  8048634:	7f 6f                	jg     80486a5 <main+0x13d>
 341 ;;      int v24 = 0;
 342  8048636:	c7 44 24 24 00 00 00 	movl   $0x0,0x24(%esp)
 343  804863d:	00 
 344 ;;      for (int j = 0; j < v20; j++) {
 345  804863e:	c7 44 24 28 00 00 00 	movl   $0x0,0x28(%esp)  ; j
 346  8048645:	00 
 347  8048646:	eb 0e                	jmp    8048656 <main+0xee>
 348 ;;          v24 += get_nextkey();
 349  8048648:	e8 9b fe ff ff       	call   80484e8 <get_nextkey>
 350  804864d:	01 44 24 24          	add    %eax,0x24(%esp)
 351 ;;      }
 352  8048651:	83 44 24 28 01       	addl   $0x1,0x28(%esp)
 353  8048656:	8b 44 24 28          	mov    0x28(%esp),%eax
 354  804865a:	3b 44 24 20          	cmp    0x20(%esp),%eax
 355  804865e:	72 e8                	jb     8048648 <main+0xe0>
 356 
 357 ;;      char g804a040[] = {...};
 358 ;;      if (g804a040[i] != v24) return 1;
 359  8048660:	8b 44 24 2c          	mov    0x2c(%esp),%eax
 360  8048664:	8b 04 85 40 a0 04 08 	mov    0x804a040(,%eax,4),%eax	# 804a040="~Y"...;
 361  804866b:	3b 44 24 24          	cmp    0x24(%esp),%eax
 362  804866f:	74 02                	je     8048673 <main+0x10b>
 363  8048671:	eb 32                	jmp    80486a5 <main+0x13d>
 364 
 365 ;;  }
 366  8048673:	83 44 24 2c 01       	addl   $0x1,0x2c(%esp)
 367  8048678:	8b 44 24 2c          	mov    0x2c(%esp),%eax
 368  804867c:	3b 44 24 20          	cmp    0x20(%esp),%eax
 369  8048680:	0f 82 5d ff ff ff    	jb     80485e3 <main+0x7b>
 370 
 371 ;;  printf("you got flag: ADCTF_%s\n", argv[1]);
 372  8048686:	8b 45 0c             	mov    0xc(%ebp),%eax
 373  8048689:	83 c0 04             	add    $0x4,%eax
 374  804868c:	8b 00                	mov    (%eax),%eax
 375  804868e:	89 44 24 04          	mov    %eax,0x4(%esp)
 376  8048692:	c7 04 24 40 87 04 08 	movl   $0x8048740,(%esp)	# 8048740="you got flag: ADCTF_%s"...;
 377  8048699:	e8 52 fc ff ff       	call   80482f0 <printf@plt>
 378  804869e:	b8 00 00 00 00       	mov    $0x0,%eax
 379  80486a3:	eb 05                	jmp    80486aa <main+0x142>
 380 
 381  80486a5:	b8 01 00 00 00       	mov    $0x1,%eax
 382  80486aa:	8b 7d fc             	mov    -0x4(%ebp),%edi
 383  80486ad:	c9                   	leave  
 384  80486ae:	c3                   	ret    
 385  80486af:	90                   	nop
 386 
 387 080486b0 <__libc_csu_init>:
 388  80486b0:	55                   	push   %ebp
 389  80486b1:	57                   	push   %edi
 390  80486b2:	31 ff                	xor    %edi,%edi
 391  80486b4:	56                   	push   %esi
 392  80486b5:	53                   	push   %ebx
 393  80486b6:	e8 95 fc ff ff       	call   8048350 <_start+0x30>
 394  80486bb:	81 c3 45 19 00 00    	add    $0x1945,%ebx
 395  80486c1:	83 ec 1c             	sub    $0x1c,%esp
 396  80486c4:	8b 6c 24 30          	mov    0x30(%esp),%ebp
 397  80486c8:	8d b3 0c ff ff ff    	lea    -0xf4(%ebx),%esi
 398  80486ce:	e8 e1 fb ff ff       	call   80482b4 <.init>	# 80482b4="S"...;
 399  80486d3:	8d 83 08 ff ff ff    	lea    -0xf8(%ebx),%eax
 400  80486d9:	29 c6                	sub    %eax,%esi
 401  80486db:	c1 fe 02             	sar    $0x2,%esi
 402  80486de:	85 f6                	test   %esi,%esi
 403  80486e0:	74 27                	je     8048709 <__libc_csu_init+0x59>
 404  80486e2:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
 405  80486e8:	8b 44 24 38          	mov    0x38(%esp),%eax
 406  80486ec:	89 2c 24             	mov    %ebp,(%esp)
 407  80486ef:	89 44 24 08          	mov    %eax,0x8(%esp)
 408  80486f3:	8b 44 24 34          	mov    0x34(%esp),%eax
 409  80486f7:	89 44 24 04          	mov    %eax,0x4(%esp)
 410  80486fb:	ff 94 bb 08 ff ff ff 	call   *-0xf8(%ebx,%edi,4)
 411  8048702:	83 c7 01             	add    $0x1,%edi
 412  8048705:	39 f7                	cmp    %esi,%edi
 413  8048707:	75 df                	jne    80486e8 <__libc_csu_init+0x38>
 414  8048709:	83 c4 1c             	add    $0x1c,%esp
 415  804870c:	5b                   	pop    %ebx
 416  804870d:	5e                   	pop    %esi
 417  804870e:	5f                   	pop    %edi
 418  804870f:	5d                   	pop    %ebp
 419  8048710:	c3                   	ret    
 420  8048711:	eb 0d                	jmp    8048720 <__libc_csu_fini>
 421  8048713:	90                   	nop
 422  8048714:	90                   	nop
 423  8048715:	90                   	nop
 424  8048716:	90                   	nop
 425  8048717:	90                   	nop
 426  8048718:	90                   	nop
 427  8048719:	90                   	nop
 428  804871a:	90                   	nop
 429  804871b:	90                   	nop
 430  804871c:	90                   	nop
 431  804871d:	90                   	nop
 432  804871e:	90                   	nop
 433  804871f:	90                   	nop
 434 
 435 08048720 <__libc_csu_fini>:
 436  8048720:	f3 c3                	repz ret 
 437 
 438 セクション .fini の逆アセンブル:
 439 
 440 08048724 <_fini>:
 441  8048724:	53                   	push   %ebx
 442  8048725:	83 ec 08             	sub    $0x8,%esp
 443  8048728:	e8 23 fc ff ff       	call   8048350 <_start+0x30>
 444  804872d:	81 c3 d3 18 00 00    	add    $0x18d3,%ebx
 445  8048733:	83 c4 08             	add    $0x8,%esp
 446  8048736:	5b                   	pop    %ebx
 447  8048737:	c3                   	ret    

Attached Files

To refer to attachments on a page, use attachment:filename, as shown below in the list of files. Do NOT use the URL of the [get] link, since this is subject to change and can break easily.
  • [get | view] (2021-03-03 17:33:03, 19.8 KB) [[attachment:guesskey.asm]]
 All files | Selected Files: delete move to page copy to page

You are not allowed to attach a file to this page.