본문 바로가기

Reversing/Dreamhack : Reverse Engineering

Quiz: x86 Assembly 1

 

 

 

mov rax, [rbx+8]
[rbx+8] = 0x401A48
0x401A48에 들어있는 값을 rax에 대입해라!

rax = 0x0000000000C0FFEE
lea rax, [rbx+8]
[rbx+8] = 0x401A48
rax에 [rax+8]의 주소를 대입

rax = 0x401A48
add rax, [rbx+rcx*8]
[rbx+rcx*8] = 0x555555554000 + 0x2 * 8 = 0x555555554010

rax = rax + 0x3 = 0x3133A
add rcx, 2
rcx = 0x4

sub rax, [rbx+rcx*8]
[rbx+rcx*8] = 0x555555554000 + 0x4 * 8 = 0x555555554000 + 0x20 = 0x555555554020

rax = rax - 0x3133A = 0
inc rax
rax = rax + 1 = 0x3133A
and rax, rcx

모두 1이여야 1, 아니면 0

rax = 1111111111111111111111111111111100000000000000000000000000000000
rcx = 0001001000110100010101100111100010011010101111001101111011110000
rax = 0001001000110100010101100111100000000000000000000000000000000000
    = 0x1234567800000000
and rbx, rcx

rbx = 0000000000000000000000000000000011111111111111111111111111111111
rcx = 0001001000110100010101100111100010011010101111001101111011110000
rbx = 0000000000000000000000000000000010011010101111001101111011110000
    = 0x09ABCDEF0
or rax, rbx

둘 중 하나라도 1이면 1, 아니면 0

rax = 0x1234567800000000
    = 0001001000110100010101100111100000000000000000000000000000000000
rbx = 0x09ABCDEF0
    = 0000000000000000000000000000000010011010101111001101111011110000
rax = 0001001000110100010101100111100010011010101111001101111011110000
    = 0x123456789ABCDEF0
xor rax, rbx
같으면 0, 다르면 1

rax = 0x35014541 = 00110101000000010100010101000001
rbx = 0xDEADBEEF = 11011110101011011011111011101111

연산 결과 : 11101011101011001111101110101110 => rax = 0xEBAF7BAE
rax = 0xEBAF7BAE = 11101011101011001111101110101110
rbx = 0xDEADBEEF = 11011110101011011011111011101111

연산 결과 : rax = 00110101000000010100010101000001 = 0x35014541
eax는 rax의 하위 32비트

rax = 0x0000000035014541  (64비트)
eax = 0x35014541

0x35014541 = 0011 0101 0000 0001 0100 0101 0100 0001
NOT        = 1100 1010 1111 1110 1011 1010 1011 1110
EAX = 0xCAFEBAAE

 

 



 

'Reversing > Dreamhack : Reverse Engineering' 카테고리의 다른 글

IDA  (0) 2025.04.16
Quiz: x86 Assembly 2-3  (0) 2025.04.16
x86 Assembly🤖: Essential Part  (0) 2025.04.16
Background: Windows Memory Layout  (0) 2025.04.16
Background: Computer Architecture  (0) 2025.04.16