Skip to content

Instantly share code, notes, and snippets.

@thoughtpolice
Created February 2, 2012 18:33
Show Gist options
  • Save thoughtpolice/1725018 to your computer and use it in GitHub Desktop.
Save thoughtpolice/1725018 to your computer and use it in GitHub Desktop.
radare yay
$ r2 -a x86.bea ./a.out
Cannot use 'x86.bea' anal plugin.
Cannot use 'x86.bea' anal plugin.
-- Change the registers of the child process in this way: '!set eax 0x333'
[0x00400490]> pD 461 @ sym.aes_test
0x004005ae sym.aes_test:
0x004005ae 53 push rbx
0x004005af ba60a04000 mov edx, sym.edst
0x004005b4 be60604000 mov esi, sym.src2
0x004005b9 bf60204000 mov edi, sym.src1
0x004005be e8b1ffffff call sym.init_data
; 0x00400574(unk)
0x004005c3 b960604000 mov ecx, sym.src2
0x004005c8 ba60204000 mov edx, sym.src1
0x004005cd b860e04000 mov eax, sym.resdst
0x004005d2 be00000000 mov esi, 0x00000000
.------> 0x004005d7 660f6f02 movdqa xmm0, [rdx]
| 0x004005db 660f38dc01 aesenc xmm0, [rcx]
| 0x004005e0 660f7f00 movdqa [rax], xmm0
| `-> 0x004005e4 660f6f4210 movdqa xmm0, [rdx+0x10]
| 0x004005e9 660f38dc4110 aesenc xmm0, [rcx+0x10]
| 0x004005ef 660f7f4010 movdqa [rax+0x10], xmm0
| | 0x004005f4 660f6f4220 movdqa xmm0, [rdx+0x20]
| | 0x004005f9 660f38dc4120 aesenc xmm0, [rcx+0x20]
| | 0x004005ff 660f7f4020 movdqa [rax+0x20], xmm0
| || 0x00400604 660f6f4230 movdqa xmm0, [rdx+0x30]
| || 0x00400609 660f38dc4130 aesenc xmm0, [rcx+0x30]
| || 0x0040060f 660f7f4030 movdqa [rax+0x30], xmm0
| ||| 0x00400614 660f6f4240 movdqa xmm0, [rdx+0x40]
| ||| 0x00400619 660f38dc4140 aesenc xmm0, [rcx+0x40]
| ||| 0x0040061f 660f7f4040 movdqa [rax+0x40], xmm0
| ||| 0x00400624 660f6f4250 movdqa xmm0, [rdx+0x50]
| ||| 0x00400629 660f38dc4150 aesenc xmm0, [rcx+0x50]
| ||| 0x0040062f 660f7f4050 movdqa [rax+0x50], xmm0
| || 0x00400634 660f6f4260 movdqa xmm0, [rdx+0x60]
| || 0x00400639 660f38dc4160 aesenc xmm0, [rcx+0x60]
| || 0x0040063f 660f7f4060 movdqa [rax+0x60], xmm0
| | 0x00400644 660f6f4270 movdqa xmm0, [rdx+0x70]
| | 0x00400649 660f38dc4170 aesenc xmm0, [rcx+0x70]
||| 0x0040064f 660f7f4070 movdqa [rax+0x70], xmm0
|| 0x00400654 660f6f8280000000 movdqa xmm0, [rdx+0x00000080]
|| 0x0040065c 660f38dc8180000. aesenc xmm0, [rcx+0x00000080]
|| 0x00400665 660f7f8080000000 movdqa [rax+0x00000080], xmm0
|| 0x0040066d 660f6f8290000000 movdqa xmm0, [rdx+0x00000090]
|| 0x00400675 660f38dc8190000. aesenc xmm0, [rcx+0x00000090]
|| 0x0040067e 660f7f8090000000 movdqa [rax+0x00000090], xmm0
|| 0x00400686 660f6f82a0000000 movdqa xmm0, [rdx+0x000000A0]
|| 0x0040068e 660f38dc81a0000. aesenc xmm0, [rcx+0x000000A0]
|| 0x00400697 660f7f80a0000000 movdqa [rax+0x000000A0], xmm0
|| 0x0040069f 660f6f82b0000000 movdqa xmm0, [rdx+0x000000B0]
|| 0x004006a7 660f38dc81b0000. aesenc xmm0, [rcx+0x000000B0]
|| 0x004006b0 660f7f80b0000000 movdqa [rax+0x000000B0], xmm0
| 0x004006b8 660f6f82c0000000 movdqa xmm0, [rdx+0x000000C0]
| 0x004006c0 660f38dc81c0000. aesenc xmm0, [rcx+0x000000C0]
| 0x004006c9 660f7f80c0000000 movdqa [rax+0x000000C0], xmm0
| 0x004006d1 660f6f82d0000000 movdqa xmm0, [rdx+0x000000D0]
| 0x004006d9 660f38dc81d0000. aesenc xmm0, [rcx+0x000000D0]
| 0x004006e2 660f7f80d0000000 movdqa [rax+0x000000D0], xmm0
| 0x004006ea 660f6f82e0000000 movdqa xmm0, [rdx+0x000000E0]
| 0x004006f2 660f38dc81e0000. aesenc xmm0, [rcx+0x000000E0]
| 0x004006fb 660f7f80e0000000 movdqa [rax+0x000000E0], xmm0
| 0x00400703 660f6f82f0000000 movdqa xmm0, [rdx+0x000000F0]
| 0x0040070b 660f38dc81f0000. aesenc xmm0, [rcx+0x000000F0]
| 0x00400714 660f7f80f0000000 movdqa [rax+0x000000F0], xmm0
| 0x0040071c 83c610 add esi, 0x10
| 0x0040071f 4881c100010000 add rcx, 0x0000000000000100
| 0x00400726 4881c200010000 add rdx, 0x0000000000000100
| 0x0040072d 480500010000 add rax, 0x0000000000000100
| 0x00400733 81fe00040000 cmp esi, 0x00000400
`======< 0x00400739 0f8598feffff jne 0x004005D7
0x0040073f bb00000000 mov ebx, 0x00000000
0x00400744 4889df mov rdi, rbx
0x00400747 48c1e704 shl rdi, 0x04
0x0040074b 488db760e04000 lea rsi, qword [rdi+sym.resdst]
0x00400752 4881c760a04000 add rdi, sym.edst
0x00400759 ba10000000 mov edx, 0x00000010
0x0040075e e80dfdffff call imp.memcmp
; imp.memcmp()
0x00400763 85c0 test eax, eax
,=======< 0x00400765 7405 je 0x0040076C
| 0x00400767 e814fdffff call imp.abort
| ; imp.abort()
`-------> 0x0040076c 4883c301 add rbx, 0x01
0x00400770 4881fb00040000 cmp rbx, 0x0000000000000400
0x00400777 75cb jne 0x00400744
0x00400779 5b pop rbx
0x0040077a c3 ret
; ------------
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment