Note Hackbuburit 2018 #1 Reverse Engineering

r2 -d ./ez

-d = debug

aaa

pdf = print disassemble function

pdf @ main

mov dword [local_70h], 0x43 == copy 0x43 ke variable local_70h

dst

db 0x7ff241e008ec
dc
dr

panjang input harus 26 karakter.

ada perulangan sebanyak 26 kali, 0 hingga 25

counter and 1 = 0 dia lompat ke 0x....953
counter and 1 = 1 dia lanjut proses dibawahnya

ambil karakter dengan posisi sesuai counter

ambil karakter sesuai variable yang sudah ditentukan

A12345678901234567890123456

local_4h = counter (dia ada di perulangan yang ke berapa?)

karakter pertama harus C

Referensi
http://www.stmikneumann.ac.id/download/assembly.pdf

mov = copy

 mov dword [local_4h], 0

 0 copy ke local_4h

 cmp dword [local_4h], 0x19 = bandingkan 0 dengan 25

 JLE = Jump Less Equal, dia akan lompat ketika nilainya kurang dari 25

 cmp dword [local_4h], 0x19

 mov eax, dword [local_4h] ->>> copy 0 ke eax
 and eax, 1 ----> 0 and 1
test eax, eax ---> test
je 0x7fd196000953 --->



   |`---> 0x7fd196000953      8b45fc         mov eax, dword [local_4h] ---> eax = 0
|    | :|   0x7fd196000958      0fb6840520ff.  movzx eax, byte [rbp + rax - 0xe0]
|    | :|   0x7fd196000960      0fbed0         movsx edx, al --> edx = karakter ke sekian (inputan)
|    | :|   0x7fd196000963      8b45fc         mov eax, dword [local_4h]
|    | :|   0x7fd196000968      8b448590       mov eax, dword [rbp + rax*4 - 0x70] --> ambil dari isi program
|    | :|   0x7fd19600096c      2b45fc         sub eax, dword [local_4h] --> sub 43, 0 ---> 43 - 0 = eax = 43 sub = substract = pengurangan
|    | :|   0x7fd19600096f      39c2           cmp edx, eax --> cmp 41,43
|    |,===< 0x7fd196000971      7416           je 0x7fd196000989

rax
eax = 32 bit
ax = 16 bit
ah  = 8 bit
al = 8 bit


db 0x7f7a67200963


panjang input harus 26 karakter.

ada perulangan sebanyak 26 kali, 0 hingga 25

$b = [0x43,0x60,0x6e,0x69,0x69,0x6e,0x7a,0x5a,0x83,0x49,0x6f,0x6b,0x51,0x6d,0x53,0x5f,0x77,0x58,0x80,0x52,0x79,0x5d,0x7f,0x57,0x7f,0x64];

for($a = 0; $a <= 25; $a++){
	if($a & 1){
		//jika true
		echo chr($b[$a] + $a);
	}else{
		//jika false
		//ambil inputan ke sekian (counter)
		//ambil dari isi program
		//hasil dari isi program - counter
		//jika sama, lanjut ke perulangan berikutnya
		//jika tidak sama, tampilkan nope & exit
		//perulangan pertama harus C
		echo chr($b[$a] - $a);
	}
}

counter and 1 = 0 dia lompat ke 0x....953
counter and 1 = 1 dia lanjut proses dibawahnya