Help Reverse Engineering (Assembly)

LtStaffel · June 22, 2017

Hello everyone,

What's up:

I'm working on a crackme and have gotten a bit stuck.

The info:

This is a C++ compiled program, ELF 32-bit.

The problem:

The C++ part is what's giving me trouble, I don't know what all the function calls do whereas in C they'd disassemble a bit more cleanly. Radare2 is the only disassembler I've used on it that's actually given human readable function names. Also, I believe I'm looking at classes and objects here? I've never seen this kind of thing before.

The disassembly:

I've attached a picture, which is all nice and colorful (<3 Radare2), but there's also a spoiler here with a text version (pictures are the bane of programming help). If you'd like to see the whole thing, I can either link you to the challenge or show you the whole disassembly. If possible though, I'd rather not do either of those because that'd be having you do all the work, which is neither a fun nor a learning experience. I need help with this segment.

Text Version:

Spoiler


	    0x08048aee      8d45eb         lea eax, dword [ebp - local_15h]
|      |    0x08048af1      890424         mov dword [esp], eax
|      |    0x08048af4      e867fdffff     call sym.std::allocator_char_::allocator
|      |    0x08048af9      8d45eb         lea eax, dword [ebp - local_15h]
|      |    0x08048afc      89442408       mov dword [esp + local_8h], eax
|      |    0x08048b00      c7442404c48d.  mov dword [esp + local_4h], 0x8048dc4 ; [0x8048dc4:4]=0xca15d618
|      |    0x08048b08      8d45f4         lea eax, dword [ebp - local_ch]
|      |    0x08048b0b      890424         mov dword [esp], eax
|      |    0x08048b0e      e80dfdffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string
|      |    0x08048b13      8d45ea         lea eax, dword [ebp - local_16h]
|      |    0x08048b16      890424         mov dword [esp], eax
|      |    0x08048b19      e842fdffff     call sym.std::allocator_char_::allocator
|      |    0x08048b1e      8d45ea         lea eax, dword [ebp - local_16h]
|      |    0x08048b21      89442408       mov dword [esp + local_8h], eax
|      |    0x08048b25      c7442404cc8d.  mov dword [esp + local_4h], 0x8048dcc ; [0x8048dcc:4]=0xaf67b350
|      |    0x08048b2d      8d45f0         lea eax, dword [ebp - local_10h]
|      |    0x08048b30      890424         mov dword [esp], eax
|      |    0x08048b33      e8e8fcffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string
|      |    0x08048b38      8d45ec         lea eax, dword [ebp - local_14h]
|      |    0x08048b3b      8d55f4         lea edx, dword [ebp - local_ch]
|      |    0x08048b3e      89542408       mov dword [esp + local_8h], edx
|      |    0x08048b42      8d55f0         lea edx, dword [ebp - local_10h]
|      |    0x08048b45      89542404       mov dword [esp + local_4h], edx
|      |    0x08048b49      890424         mov dword [esp], eax
|      |    0x08048b4c      e83cfeffff     call sym.plouf

Picture Version:

Spoiler