Skip to content

Instantly share code, notes, and snippets.

@agustingianni
Created December 5, 2009 21:37
Show Gist options
  • Select an option

  • Save agustingianni/249871 to your computer and use it in GitHub Desktop.

Select an option

Save agustingianni/249871 to your computer and use it in GitHub Desktop.
Second pass
Entry point: <class=Symbol, name="_init", value=0x8048298, size=0>
0: push ebp
1: mov ebp,esp
3: push ebx
4: sub esp,0x4
7: call 0xc
12: pop ebx
13: add ebx,0x1d50
19: mov edx,[ebx-0x4]
25: test edx,edx
27: jz 0x22
29: call 0x40
34: call 0x108
39: call 0x208
44: pop eax
45: pop ebx
46: leave
47: ret
Entry point: <class=Symbol, name="_start", value=0x8048310, size=0>
0: xor ebp,ebp
2: pop esi
3: mov ecx,esp
5: and esp,0xfffffff0
8: push eax
9: push esp
10: push edx
11: push dword 0x8048430
16: push dword 0x8048440
21: push ecx
22: push esi
23: push dword 0x80483c4
28: call 0xffffffd8
33: hlt
34: nop
35: nop
36: nop
37: nop
38: nop
39: nop
40: nop
41: nop
42: nop
43: nop
44: nop
45: nop
46: nop
47: nop
48: push ebp
49: mov ebp,esp
51: push ebx
52: sub esp,0x4
55: cmp byte [0x804a014],0x0
62: jnz 0x80
64: mov edx,[0x804a018]
70: mov eax,0x8049f18
75: sub eax,0x8049f14
80: sar eax,0x2
83: lea ebx,[eax-0x1]
86: cmp edx,ebx
88: jnc 0x79
90: lea esi,[esi+0x0]
96: lea eax,[edx+0x1]
99: mov [0x804a018],eax
104: call [eax*4+0x8049f14]
111: mov edx,[0x804a018]
117: cmp edx,ebx
119: jc 0x60
121: mov byte [0x804a014],0x1
128: add esp,0x4
131: pop ebx
132: pop ebp
133: ret
134: lea esi,[esi+0x0]
137: lea edi,[edi+0x0]
144: push ebp
145: mov ebp,esp
147: sub esp,0x8
150: mov eax,[0x8049f1c]
155: test eax,eax
157: jz 0xb1
159: mov eax,0x0
164: test eax,eax
166: jz 0xb1
168: mov dword [esp],0x8049f1c
175: call eax
177: leave
178: ret
179: nop
180: lea ecx,[esp+0x4]
184: and esp,0xfffffff0
187: push dword [ecx-0x4]
190: push ebp
191: mov ebp,esp
193: push ecx
194: sub esp,0x24
197: mov dword [ebp-0x8],0x9
204: mov eax,[ebp-0x8]
207: mov [esp+0x4],eax
211: mov dword [esp],0x80484f0
218: call 0xffffffe8
223: mov dword [ebp-0x8],0x9
230: jmp 0xff
232: mov eax,[ebp-0x8]
235: mov [esp+0x4],eax
239: mov dword [esp],0x80484f6
246: call 0xffffffe8
251: add dword [ebp-0x8],0x1
255: cmp dword [ebp-0x8],0x9
259: jng 0xe8
261: mov eax,0x0
266: add esp,0x24
269: pop ecx
270: pop ebp
271: lea esp,[ecx-0x4]
274: ret
275: nop
276: nop
277: nop
278: nop
279: nop
280: nop
281: nop
282: nop
283: nop
284: nop
285: nop
286: nop
287: nop
288: push ebp
289: mov ebp,esp
291: pop ebp
292: ret
293: lea esi,[esi+0x0]
297: lea edi,[edi+0x0]
304: push ebp
305: mov ebp,esp
307: push edi
308: push esi
309: push ebx
310: call 0x18a
315: add ebx,0x1ba9
321: sub esp,0xc
324: call 0xffffff88
329: lea edi,[ebx-0xe8]
335: lea eax,[ebx-0xe8]
341: sub edi,eax
343: sar edi,0x2
346: test edi,edi
348: jz 0x182
350: xor esi,esi
352: mov eax,[ebp+0x10]
355: mov [esp+0x8],eax
359: mov eax,[ebp+0xc]
362: mov [esp+0x4],eax
366: mov eax,[ebp+0x8]
369: mov [esp],eax
372: call [ebx+esi*4-0xe8]
379: add esi,0x1
382: cmp esi,edi
384: jc 0x160
386: add esp,0xc
389: pop ebx
390: pop esi
391: pop edi
392: pop ebp
393: ret
394: mov ebx,[esp]
397: ret
398: nop
399: nop
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="__do_global_dtors_aux", value=0x8048340, size=0>
48: push ebp
49: mov ebp,esp
51: push ebx
52: sub esp,0x4
55: cmp byte [0x804a014],0x0
62: jnz 0x80
64: mov edx,[0x804a018]
70: mov eax,0x8049f18
75: sub eax,0x8049f14
80: sar eax,0x2
83: lea ebx,[eax-0x1]
86: cmp edx,ebx
88: jnc 0x79
90: lea esi,[esi+0x0]
96: lea eax,[edx+0x1]
99: mov [0x804a018],eax
104: call [eax*4+0x8049f14]
111: mov edx,[0x804a018]
117: cmp edx,ebx
119: jc 0x60
121: mov byte [0x804a014],0x1
128: add esp,0x4
131: pop ebx
132: pop ebp
133: ret
134: lea esi,[esi+0x0]
137: lea edi,[edi+0x0]
144: push ebp
145: mov ebp,esp
147: sub esp,0x8
150: mov eax,[0x8049f1c]
155: test eax,eax
157: jz 0xb1
159: mov eax,0x0
164: test eax,eax
166: jz 0xb1
168: mov dword [esp],0x8049f1c
175: call eax
177: leave
178: ret
179: nop
180: lea ecx,[esp+0x4]
184: and esp,0xfffffff0
187: push dword [ecx-0x4]
190: push ebp
191: mov ebp,esp
193: push ecx
194: sub esp,0x24
197: mov dword [ebp-0x8],0x9
204: mov eax,[ebp-0x8]
207: mov [esp+0x4],eax
211: mov dword [esp],0x80484f0
218: call 0xffffffe8
223: mov dword [ebp-0x8],0x9
230: jmp 0xff
232: mov eax,[ebp-0x8]
235: mov [esp+0x4],eax
239: mov dword [esp],0x80484f6
246: call 0xffffffe8
251: add dword [ebp-0x8],0x1
255: cmp dword [ebp-0x8],0x9
259: jng 0xe8
261: mov eax,0x0
266: add esp,0x24
269: pop ecx
270: pop ebp
271: lea esp,[ecx-0x4]
274: ret
275: nop
276: nop
277: nop
278: nop
279: nop
280: nop
281: nop
282: nop
283: nop
284: nop
285: nop
286: nop
287: nop
288: push ebp
289: mov ebp,esp
291: pop ebp
292: ret
293: lea esi,[esi+0x0]
297: lea edi,[edi+0x0]
304: push ebp
305: mov ebp,esp
307: push edi
308: push esi
309: push ebx
310: call 0x18a
315: add ebx,0x1ba9
321: sub esp,0xc
324: call 0xffffff88
329: lea edi,[ebx-0xe8]
335: lea eax,[ebx-0xe8]
341: sub edi,eax
343: sar edi,0x2
346: test edi,edi
348: jz 0x182
350: xor esi,esi
352: mov eax,[ebp+0x10]
355: mov [esp+0x8],eax
359: mov eax,[ebp+0xc]
362: mov [esp+0x4],eax
366: mov eax,[ebp+0x8]
369: mov [esp],eax
372: call [ebx+esi*4-0xe8]
379: add esi,0x1
382: cmp esi,edi
384: jc 0x160
386: add esp,0xc
389: pop ebx
390: pop esi
391: pop edi
392: pop ebp
393: ret
394: mov ebx,[esp]
397: ret
398: nop
399: nop
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="frame_dummy", value=0x80483a0, size=0>
144: push ebp
145: mov ebp,esp
147: sub esp,0x8
150: mov eax,[0x8049f1c]
155: test eax,eax
157: jz 0xb1
159: mov eax,0x0
164: test eax,eax
166: jz 0xb1
168: mov dword [esp],0x8049f1c
175: call eax
177: leave
178: ret
179: nop
180: lea ecx,[esp+0x4]
184: and esp,0xfffffff0
187: push dword [ecx-0x4]
190: push ebp
191: mov ebp,esp
193: push ecx
194: sub esp,0x24
197: mov dword [ebp-0x8],0x9
204: mov eax,[ebp-0x8]
207: mov [esp+0x4],eax
211: mov dword [esp],0x80484f0
218: call 0xffffffe8
223: mov dword [ebp-0x8],0x9
230: jmp 0xff
232: mov eax,[ebp-0x8]
235: mov [esp+0x4],eax
239: mov dword [esp],0x80484f6
246: call 0xffffffe8
251: add dword [ebp-0x8],0x1
255: cmp dword [ebp-0x8],0x9
259: jng 0xe8
261: mov eax,0x0
266: add esp,0x24
269: pop ecx
270: pop ebp
271: lea esp,[ecx-0x4]
274: ret
275: nop
276: nop
277: nop
278: nop
279: nop
280: nop
281: nop
282: nop
283: nop
284: nop
285: nop
286: nop
287: nop
288: push ebp
289: mov ebp,esp
291: pop ebp
292: ret
293: lea esi,[esi+0x0]
297: lea edi,[edi+0x0]
304: push ebp
305: mov ebp,esp
307: push edi
308: push esi
309: push ebx
310: call 0x18a
315: add ebx,0x1ba9
321: sub esp,0xc
324: call 0xffffff88
329: lea edi,[ebx-0xe8]
335: lea eax,[ebx-0xe8]
341: sub edi,eax
343: sar edi,0x2
346: test edi,edi
348: jz 0x182
350: xor esi,esi
352: mov eax,[ebp+0x10]
355: mov [esp+0x8],eax
359: mov eax,[ebp+0xc]
362: mov [esp+0x4],eax
366: mov eax,[ebp+0x8]
369: mov [esp],eax
372: call [ebx+esi*4-0xe8]
379: add esi,0x1
382: cmp esi,edi
384: jc 0x160
386: add esp,0xc
389: pop ebx
390: pop esi
391: pop edi
392: pop ebp
393: ret
394: mov ebx,[esp]
397: ret
398: nop
399: nop
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="main", value=0x80483c4, size=95>
180: lea ecx,[esp+0x4]
184: and esp,0xfffffff0
187: push dword [ecx-0x4]
190: push ebp
191: mov ebp,esp
193: push ecx
194: sub esp,0x24
197: mov dword [ebp-0x8],0x9
204: mov eax,[ebp-0x8]
207: mov [esp+0x4],eax
211: mov dword [esp],0x80484f0
218: call 0xffffffe8
223: mov dword [ebp-0x8],0x9
230: jmp 0xff
232: mov eax,[ebp-0x8]
235: mov [esp+0x4],eax
239: mov dword [esp],0x80484f6
246: call 0xffffffe8
251: add dword [ebp-0x8],0x1
255: cmp dword [ebp-0x8],0x9
259: jng 0xe8
261: mov eax,0x0
266: add esp,0x24
269: pop ecx
270: pop ebp
271: lea esp,[ecx-0x4]
274: ret
275: nop
276: nop
277: nop
278: nop
279: nop
280: nop
281: nop
282: nop
283: nop
284: nop
285: nop
286: nop
287: nop
288: push ebp
289: mov ebp,esp
291: pop ebp
292: ret
293: lea esi,[esi+0x0]
297: lea edi,[edi+0x0]
304: push ebp
305: mov ebp,esp
307: push edi
308: push esi
309: push ebx
310: call 0x18a
315: add ebx,0x1ba9
321: sub esp,0xc
324: call 0xffffff88
329: lea edi,[ebx-0xe8]
335: lea eax,[ebx-0xe8]
341: sub edi,eax
343: sar edi,0x2
346: test edi,edi
348: jz 0x182
350: xor esi,esi
352: mov eax,[ebp+0x10]
355: mov [esp+0x8],eax
359: mov eax,[ebp+0xc]
362: mov [esp+0x4],eax
366: mov eax,[ebp+0x8]
369: mov [esp],eax
372: call [ebx+esi*4-0xe8]
379: add esi,0x1
382: cmp esi,edi
384: jc 0x160
386: add esp,0xc
389: pop ebx
390: pop esi
391: pop edi
392: pop ebp
393: ret
394: mov ebx,[esp]
397: ret
398: nop
399: nop
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="__libc_csu_fini", value=0x8048430, size=5>
288: push ebp
289: mov ebp,esp
291: pop ebp
292: ret
293: lea esi,[esi+0x0]
297: lea edi,[edi+0x0]
304: push ebp
305: mov ebp,esp
307: push edi
308: push esi
309: push ebx
310: call 0x18a
315: add ebx,0x1ba9
321: sub esp,0xc
324: call 0xffffff88
329: lea edi,[ebx-0xe8]
335: lea eax,[ebx-0xe8]
341: sub edi,eax
343: sar edi,0x2
346: test edi,edi
348: jz 0x182
350: xor esi,esi
352: mov eax,[ebp+0x10]
355: mov [esp+0x8],eax
359: mov eax,[ebp+0xc]
362: mov [esp+0x4],eax
366: mov eax,[ebp+0x8]
369: mov [esp],eax
372: call [ebx+esi*4-0xe8]
379: add esi,0x1
382: cmp esi,edi
384: jc 0x160
386: add esp,0xc
389: pop ebx
390: pop esi
391: pop edi
392: pop ebp
393: ret
394: mov ebx,[esp]
397: ret
398: nop
399: nop
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="__libc_csu_init", value=0x8048440, size=90>
304: push ebp
305: mov ebp,esp
307: push edi
308: push esi
309: push ebx
310: call 0x18a
315: add ebx,0x1ba9
321: sub esp,0xc
324: call 0xffffff88
329: lea edi,[ebx-0xe8]
335: lea eax,[ebx-0xe8]
341: sub edi,eax
343: sar edi,0x2
346: test edi,edi
348: jz 0x182
350: xor esi,esi
352: mov eax,[ebp+0x10]
355: mov [esp+0x8],eax
359: mov eax,[ebp+0xc]
362: mov [esp+0x4],eax
366: mov eax,[ebp+0x8]
369: mov [esp],eax
372: call [ebx+esi*4-0xe8]
379: add esi,0x1
382: cmp esi,edi
384: jc 0x160
386: add esp,0xc
389: pop ebx
390: pop esi
391: pop edi
392: pop ebp
393: ret
394: mov ebx,[esp]
397: ret
398: nop
399: nop
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="__i686.get_pc_thunk.bx", value=0x804849a, size=0>
394: mov ebx,[esp]
397: ret
398: nop
399: nop
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="__do_global_ctors_aux", value=0x80484a0, size=0>
400: push ebp
401: mov ebp,esp
403: push ebx
404: sub esp,0x4
407: mov eax,[0x8049f0c]
412: cmp eax,0xffffffff
415: jz 0x1b4
417: mov ebx,0x8049f0c
422: nop
424: sub ebx,0x4
427: call eax
429: mov eax,[ebx]
431: cmp eax,0xffffffff
434: jnz 0x1a8
436: add esp,0x4
439: pop ebx
440: pop ebp
441: ret
442: nop
443: nop
Entry point: <class=Symbol, name="_fini", value=0x80484cc, size=0>
0: push ebp
1: mov ebp,esp
3: push ebx
4: sub esp,0x4
7: call 0xc
12: pop ebx
13: add ebx,0x1b1c
19: call 0xfffffe74
24: pop ecx
25: pop ebx
26: leave
27: ret
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment