#advanced

[Step-9] ds and px @rbp-0x8 explained

... continued from here

Hence our command "ds" in Step-9 (see screenshot) actually excutes instruction next to mov dword [local_ch], 4 which is mov dword [local_8h], 5 as seen from screenshot (box-3)

When mov dword [local_8h], 5 gets executed using "ds", the constant "5" is stored in variable "local_8h"

Let's examine the variable local_8h now using px @rbp-0x8 ~ screenshot (box-2)

Note: We're using @rbp-0x8 with "px" (alias for print hexadecimal) because rbp-0x8 is actual memory location of variable local_8h

We can confirm value of "local_8h" is indeed "5" see screenshot (box-3)

Queries & suggestions @Revnexbot

1520X Corel © Painter Essentials 7

Website: here

Send screenshots @Revnexbot

#advanced

[Step-10] pdf once again

Let's print the disassembly function using command "pdf"

Box-2 shows where our instruction pointer (rip) currently is i.e. just after mov dword [local_8h], 5 (box-3) - the instruction that we've executed in last step using "ds"

What if we run "ds" again?

Let's see

Queries & suggestions @Revnexbot

#advanced

[Step-11] dr[?]

Command "dr" is used to print 'gpr' (general purpose) registers

We can also print value of a specific register using dr <register>

In above screenshot, we run "ds" (box-1) again and it executes next instruction mov edx, dword [local_ch] (box-3)

What does "mov edx, dword [local_ch]" do?

Value of variable local_ch is moved to edx register

We know from here (click) local_ch is "4" and hence after "ds" is executed edx becomes "4" as well

After running next command "dr", we can see ¹rdx is indeed "4" (0x00000004) ~ see above screenshot

¹Note: edx is the low 32 bit of the rdx register, which is a 64 bit register

Queries & suggestions @Revnexbot

1X Tabnine pro

https://my.tabnine.com/login

John Doe
01071190096@student.uph.edu
Password: Qwerty-1234

Send screenshots @Revnexbot

#advanced

[Step-12] step read repeat

1. Step to next instruction

Let's step to next instruction "mov eax, dword [local_8h]" with "ds" ("local_8h" i.e. "5" is moved to eax)

2. Read general purpose registers

Print gpr using "dr" and confirm value of rax is indeed "5" 0x00000005

3. Repeat steps 1 and 2

Running "ds" once again should now execute "add eax, edx" ~ adds rax "5" and rdx "4" stores the sum in rax

Using "dr", we can see rax is "9" 0x00000009 as expected

4. End

Before executing next instruction "mov dword [local_4h], eax", print the variable "local_4h" using "px @rbp-0x4"

We get "00"

Next instruction is "mov dword [local_4h], eax"

Execute it using "ds" and run "px @rbp-0x4" again, we get "09" expected as value of rax was 0x00000009

Queries & suggestions @Revnexbot

#advanced

[Step-13] "end" ?

Recall that the binary is actually a program that adds up two variables "a" and "b" and stores the result in another variable "c" where "a" and "b" are constants "4" and "5" respectively

Explanation

To get an insight of actual program structure, we reversed "run" using radare

Source code breakdown

Integer a "local_ch" is declared
"var int local_ch @ rbp-0xc"

Similarly, variables b "local_8h" and c "local_4h" are declared

Variable a is assigned constant 4 "mov dword [local_ch], 4" and b is assigned constant "5"

To add them together, we utilised the unused registers "eax" and "edx"

Variables a and b are added as edx and eax respectively "add eax, edx", and result is assigned to variable c "local_4h" afterwards "mov dword [local_4h], eax"

Queries & suggestions @Revnexbot

2258X Mega.nz Pro (personal use)

Redeem: here

Send screenshots @Revnexbot

Thanks 🥰

👉 @Fourmorescreenshots

Truecaller bot (@RespawnRobot) update

100k users in less than a month, and now — "It's a good bye👋🏻"

Are you a hacker?

It's a message out there for those who can support us —

We need your help!

If you're a hacker, professional coder or someone who can support us —

1. Integrate "last seen" feature

2. Evade bot searches being detected and blocked by truecaller

3. Buy us some proxies

Please connect to us @Revnexbot