Translating assembly to pseudocode

Question

I'm working on a homework project involving a "bomb" written in compiled c which I have to reverse-engineer to come up with 5 strings which will disarm each of five "phases" of the bomb. I'm stuck on phase 3 right now, trying to translate the assembly (x86, AT&T syntax I believe) produced by gdb for that function. What I've been able to figure out so far is that it is trying to take a string of six numbers as user input and judge them on some criteria, but that's where I'm losing it. The function is as follows (with my attempted pseudocode translation next to it). ``` 0x08048816 : push %ebp 0x08048817 : mov %esp,%ebp 0x08048819 : push %edi 0x0804881a : push %ebx 0x0804881b : sub $0x30,%esp 0x0804881e : lea -0x24(%ebp),%eax 0x08048821 : mov %eax,0x4(%esp) 0x08048825 : mov 0x8(%ebp),%eax 0x08048828 : mov %eax,(%esp) 0x0804882b : call 0x8048d2c 0x08048830 <…

Accepted Answer

```
mov    -0x24(%ebp,%eax,4),%eax
```

The above instruction is accessing an element of an array. This is called `SIB` addressing in x86, for Scale, Index, Base. There is also an Offset component. The array is based at an address determined by the Base register (`EBP` here) plus an offset (when using a frame pointer, local variables, including arrays, are addressed as an offset from the frame pointer). The element number is at the Index register (`EAX` here). The size of each element is determined by the Scale (`4` here).

```
mov    0x804a6d8,%eax
mov    $0xffffffff,%ecx
mov    %eax,-0x2c(%ebp)
mov    $0x0,%eax
cld                         
mov    -0x2c(%ebp),%edi
repnz scas %es:(%edi),%al
mov    %ecx,%eax
not    %eax
sub    $0x1,%eax
```

This is just `strlen(0x805a6d8)`. `ES:EDI` points to a string to scan (compare agains a reference byte) at `0x804a6d8`. `AL` contains the character to scan for: `0` - `ASCII NUL`. `cld` sets the direction for the scan: ascending (`std` would make the scan descending). `ECX` is initialized to `~0 = -1`: all bits 1. `repnz` repeats the `scas` (SCAN STRING) instruction decrementing `ECX` while `ECX` is not zero (which will not happen since ECX is big enough to prevent that) and the scan is not successful (NZ, while the scan (compare between the string and the reference AL) didn't set the zero flag). After that, `ECX` contains `-1-(steps in the scan)`. `NOT` makes that `(steps in the scan)`. `SUB` makes that `(steps in the scan) - 1 = (length of string not including the terminating NUL)`. Also explained at http://www.int80h.org/strlen/.

Translating assembly to pseudocode

Solution

Problem