previous | start | next

Reverse Engineering Example

A function with this declaration is called:

      void phase_1(char input[]);
   

Here is the assembler listing:

0x08048524 <phase_1+0>: push   %ebp
0x08048525 <phase_1+1>: mov    %esp,%ebp
0x08048527 <phase_1+3>: sub    $0x28,%esp
0x0804852a <phase_1+6>: lea    -0x10(%ebp),%eax
0x0804852d <phase_1+9>: mov    %eax,0xc(%esp)
0x08048531 <phase_1+13>:        lea    -0xc(%ebp),%eax
0x08048534 <phase_1+16>:        mov    %eax,0x8(%esp)
0x08048538 <phase_1+20>:        movl   $0x80486b0,0x4(%esp)
0x08048540 <phase_1+28>:        mov    0x8(%ebp),%eax
0x08048543 <phase_1+31>:        mov    %eax,(%esp)
0x08048546 <phase_1+34>:        call   0x8048358 <sscanf@plt>
0x0804854b <phase_1+39>:        mov    %eax,-0x4(%ebp)
0x0804854e <phase_1+42>:        cmpl   $0x2,-0x4(%ebp)
0x08048552 <phase_1+46>:        je     0x8048559 <phase_1+53>
0x08048554 <phase_1+48>:        call   0x804856d <explode>
0x08048559 <phase_1+53>:        mov    -0xc(%ebp),%eax
0x0804855c <phase_1+56>:        lea    (%eax,%eax,1),%edx
0x0804855f <phase_1+59>:        mov    -0x10(%ebp),%eax
0x08048562 <phase_1+62>:        cmp    %eax,%edx
0x08048564 <phase_1+64>:        je     0x804856b <phase_1+71>
0x08048566 <phase_1+66>:        call   0x804856d <explode>
0x0804856b <phase_1+71>:        leave
0x0804856c <phase_1+72>:        ret

Identify the addresses of local variables, the parameter, and register usage.



previous | start | next