asm4

Problem

What will asm4("picoCTF_376ee") return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. Source located in the directory at /problems/asm4_2_0932017a5f5efe2bc813afd0fe0603aa.

Solution

  1. 1.
    Let's look at the source:
    asm4:
    <+0>: push ebp
    <+1>: mov ebp,esp
    <+3>: push ebx
    <+4>: sub esp,0x10
    <+7>: mov DWORD PTR [ebp-0x10],0x25c
    <+14>: mov DWORD PTR [ebp-0xc],0x0
    <+21>: jmp 0x518 <asm4+27>
    <+23>: add DWORD PTR [ebp-0xc],0x1
    <+27>: mov edx,DWORD PTR [ebp-0xc]
    <+30>: mov eax,DWORD PTR [ebp+0x8]
    <+33>: add eax,edx
    <+35>: movzx eax,BYTE PTR [eax]
    <+38>: test al,al
    <+40>: jne 0x514 <asm4+23>
    <+42>: mov DWORD PTR [ebp-0x8],0x1
    <+49>: jmp 0x587 <asm4+138>
    <+51>: mov edx,DWORD PTR [ebp-0x8]
    <+54>: mov eax,DWORD PTR [ebp+0x8]
    <+57>: add eax,edx
    <+59>: movzx eax,BYTE PTR [eax]
    <+62>: movsx edx,al
    <+65>: mov eax,DWORD PTR [ebp-0x8]
    <+68>: lea ecx,[eax-0x1]
    <+71>: mov eax,DWORD PTR [ebp+0x8]
    <+74>: add eax,ecx
    <+76>: movzx eax,BYTE PTR [eax]
    <+79>: movsx eax,al
    <+82>: sub edx,eax
    <+84>: mov eax,edx
    <+86>: mov edx,eax
    <+88>: mov eax,DWORD PTR [ebp-0x10]
    <+91>: lea ebx,[edx+eax*1]
    <+94>: mov eax,DWORD PTR [ebp-0x8]
    <+97>: lea edx,[eax+0x1]
    <+100>: mov eax,DWORD PTR [ebp+0x8]
    <+103>: add eax,edx
    <+105>: movzx eax,BYTE PTR [eax]
    <+108>: movsx edx,al
    <+111>: mov ecx,DWORD PTR [ebp-0x8]
    <+114>: mov eax,DWORD PTR [ebp+0x8]
    <+117>: add eax,ecx
    <+119>: movzx eax,BYTE PTR [eax]
    <+122>: movsx eax,al
    <+125>: sub edx,eax
    <+127>: mov eax,edx
    <+129>: add eax,ebx
    <+131>: mov DWORD PTR [ebp-0x10],eax
    <+134>: add DWORD PTR [ebp-0x8],0x1
    <+138>: mov eax,DWORD PTR [ebp-0xc]
    <+141>: sub eax,0x1
    <+144>: cmp DWORD PTR [ebp-0x8],eax
    <+147>: jl 0x530 <asm4+51>
    <+149>: mov eax,DWORD PTR [ebp-0x10]
    <+152>: add esp,0x10
    <+155>: pop ebx
    <+156>: pop ebp
    <+157>: ret
  2. 2.
    Since this challenge is more complicated than challenges asm1 and asm2, we will compile and run it using a different method than asm3.
  3. 3.
    We can compile the function into a C file using the following syntax (source):
    #include <stdio.h>
    #include <stdlib.h>
    int asm4(char* in)
    {
    int val;
    asm (
    "nop;"
    "nop;"
    "nop;"
    //"push ebp;"
    //"mov ebp,esp;"
    "push ebx;"
    "sub esp,0x10"
    "mov DWORD PTR [ebp-0x10],0x25c"
    "mov DWORD PTR [ebp-0xc],0x0"
    "jmp _asm_27;"
    "_asm_23:"
    "add DWORD PTR [ebp-0xc],0x1;"
    "_asm_27:"
    "mov edx,DWORD PTR [ebp-0xc];"
    "mov eax,DWORD PTR [%[pInput]];"
    "add eax,edx;"
    "movzx eax,BYTE PTR [eax];"
    "test al,al;"
    "jne _asm_23;"
    "mov DWORD PTR [ebp-0x8],0x1;"
    "jmp _asm_138;"
    "_asm_51:"
    "mov edx,DWORD PTR [ebp-0x8];"
    "mov eax,DWORD PTR [%[pInput]];"
    "add eax,edx;"
    "movzx eax,BYTE PTR [eax];"
    "movsx edx,al;"
    "mov eax,DWORD PTR [ebp-0x8];"
    "lea ecx,[eax-0x1];"
    "mov eax,DWORD PTR [%[pInput]];"
    "add eax,ecx;"
    "movzx eax,BYTE PTR [eax];"
    "movsx eax,al;"
    "sub edx,eax;"
    "mov eax,edx;"
    "mov edx,eax;"
    "mov eax,DWORD PTR [ebp-0x10];"
    "lea ebx,[edx+eax*1];"
    "mov eax,DWORD PTR [ebp-0x8];"
    "lea edx,[eax+0x1];"
    "mov eax,DWORD PTR [%[pInput]];"
    "add eax,edx;"
    "movzx eax,BYTE PTR [eax];"
    "movsx edx,al;"
    "mov ecx,DWORD PTR [ebp-0x8];"
    "mov eax,DWORD PTR [%[pInput]];"
    "add eax,ecx;"
    "movzx eax,BYTE PTR [eax];"
    "movsx eax,al;"
    "sub edx,eax;"
    "mov eax,edx;"
    "add eax,ebx;"
    "mov DWORD PTR [ebp-0x10],eax;"
    "add DWORD PTR [ebp-0x8],0x1;"
    "_asm_138:"
    "mov eax,DWORD PTR [ebp-0xc];"
    "sub eax,0x1;"
    "cmp DWORD PTR [ebp-0x8],eax;"
    "jl _asm_51;"
    "mov eax,DWORD PTR [ebp-0x10];"
    "add esp,0x10;"
    "pop ebx;"
    //"pop ebp;"
    //"ret ;"
    "nop;"
    "nop;"
    "nop;"
    :"=r"(val)
    : [pInput] "m"(in)
    );
    return val;
    }
    int main(int argc, char** argv)
    {
    printf("0x%x\n", asm4("picoCTF_376ee"));
    return 0;
    }
    Note that jumps were ported to use labels, the input parameter was renamed and the frame setup and teardown were already taken care of by the compiler and therefore commented out in the assembly. The nops were inserted in order to make it easier to locate the inline assembly with a debugger or disassembler. An alternative was to use a dedicated assembly file as we did in asm3.
  4. 4.
    Compile by running gcc -masm=intel -m32 solve.c -o solve.
  5. 5.
    Run the solve.c file with ./solve

Flag

0x24d
Last modified 2yr ago