CODEWITHSUNDEEP
assemblyx86-64reverse-engineering
Talon Stromgren
Talon Stromgren

Reputation: 21

How to Read a Function From a Dissasembled Binary File?

I'm trying to figure out what some functions in a binary do and this is one of them. I've been researching for hours on end and this seems like an easy function, but I am new to this so I'm unsure. What I have so far is that it looks like 3 arguments are of type short and 1 is type long long. There is a print statment at the end as well, so is it just printing out the variables? 

70: sym.func.100000d00 (int64_t arg1, int64_t `arg3, int64_t arg4, int64_t arg7);
; var int64_t var_1ch @ rbp-0x1c
; var int64_t var_18h @ rbp-0x18
; var int64_t var_10h @ rbp-0x10
; var int64_t var_ch @ rbp-0xc
; var int64_t var_5h @ rbp-0x5
; var int64_t var_4h @ rbp-0x4
; arg int64_t arg1 @ rdi
; arg int64_t arg3 @ rdx
; arg int64_t arg4 @ rcx
; arg int64_t arg7 @ xmm0
0x100000d00      push rbp          ; [00] -r-x section size 549 named 0.__TEXT.__text
0x100000d01      mov rbp, rsp
0x100000d04      sub rsp, 0x20
0x100000d08      mov al, sil
0x100000d0b      mov dword [var_4h], edi ; arg1
0x100000d0e      mov byte [var_5h], al
0x100000d11      mov dword [var_ch], edx ; arg3
0x100000d14      mov dword [var_10h], ecx ; arg4
0x100000d17      movsd qword [var_18h], xmm0 ; arg7
0x100000d1c      mov esi, dword [var_4h]
0x100000d1f      mov edx, dword [var_ch]
0x100000d22      mov ecx, dword [var_10h]
0x100000d25      movsd xmm0, qword [var_18h]
0x100000d2a      movsx r8d, byte [var_5h]
0x100000d2f      lea rdi, qword str.d__2d:_2d:_6.3lf__cM ; 0x100000f58 ; const char *format
0x100000d36      mov al, 1
0x100000d38      call section.1.__TEXT.__stubs ; sym.imp.printf ; int printf(const char *format)
0x100000d3d      mov dword [var_1ch], eax
0x100000d40      add rsp, 0x20
0x100000d44      pop rbp
0x100000d45      ret

Upvotes: 0

Views: 373

Answers (1)

Jester
Jester

Reputation: 58762

int foo(int a, char b, int c, int d, double e)
{
    int printed = printf("%d %2d:%2d:%6.3lf %cM", a, c, d, e, b);
    return printed;
}

Note that the double e argument could be in any position as that can not be deduced from the calling convention. Also the format string is at address 0x100000f58 examine it yourself as I have only attempted to reconstruct that from the generated symbolic name.

Upvotes: 1

Related Questions