Challenge #18

This challenge has more code, but according to the description is not a big deal. Here is the short description that you can find always here:

Now this is easy. Keep in mind, the code is 64-bit, because it uses 64-bit value(s). That is why I've omitted code fragments for 32-bit ARM and MIPS. So what does it do?

As always with large code, will avoid to display the whole code in this article, because large code of assembly can cause brain damage. I bet there's a "legit" study about that...academy. Also because you can find the code example in the original website here.

Analysis

As always let's break this code into blocks, in order to understand it better. The first block that I'm going to analyze it's this one

    ;; check if the string in rsp
    ;; has length 36
    sub rsp, 24
    mov QWORD PTR [rsp], r8
    mov QWORD PTR [rsp+8], r9
    call    strlen
    cmp rax, 36
    mov edx, -1
    jne .L28 ;; EXIT PROGRAM

    mov r12, rbx ;; copy rdi string into r12
    xor ebp, ebp ;; ebp = 0
    jmp .L35

I added some notations into the block code, here we have a call to strlen, famous C function, to know the length of a string(assuming it's \0 terminated). In case our string length is not 36 we jump to tag .L28, where is the exit of the program, returning -1. This should count as a failure example, so on failure we are returning -1.

Another thing to identify here, it's the presence of a loop, between tags
.L33 and .L.42. Over what iterate this loop? What is the stop condition here? It's easy to notice that we are iterating over the string we just copied into r12 register. Take a look at this snippet

;; START OF A LOOP
;; ------------------>
.L33:
    ;; if char it's hex, end program with -1
    movsx   edi, BYTE PTR [r12]
    call    isxdigit
    test    eax, eax
    je  .L37 ;; EXIT PROGRAM WITH -1

;; ... continuation other tags come between these two

.L42:
    ;; check if we are in the last char
    cmp BYTE PTR [r12], 0
    jne .L33
    ;; <<<<<<<<<<<<<<<<<<<
    ;; END OF A LOOP
    ;; <<<<<<<<<<<<<<<<<<<

If you noticed, at the end of tag .L42 we have a check for the amazing \0 null terminating character. Also at the start of the tag .L33, we have a copy of one character from the string in r12. This give us the certainty we are iterating over string in r12.

Another point to notice here, is the call to isxdigit, for checking if the current character it's a hexadecimal digit. In case is not, we finish the program as well with -1. Given that this is inside a loop, we can infer that each character in the string should be a valid hexadecimal digit, otherwise we exit the program with failure code -1.

We haven't analyzed everything and we have already an idea, that this program it's checking if all the characters on the string are hex. Cool, let's continue

The loop

The body of the loop gives us some insights as well. For example tag .L32, contains the increments of the loop, here you can notice that we have a counter in ebp register, and we also increment the string in r12 of course.

.L32:
    ;; increase counter and string pointer position
    add ebp, 1
    add r12, 1
    cmp ebp, 37
    je  .L34
.L35:
    cmp ebp, 8
    jne .L43
.L29:
    ;; if negative sign, continue
    cmp BYTE PTR [r12], 45 ;; '-' ascii, negative number
    je  .L32
.L37:
    ;; if we get here the program will exit with -1
    mov edx, -1

Another operation here is the comparison to 37 of our counter in ebp. Remember our string's length must be 36. Also keep in mind C strings have a null terminated character.

We can also see that on tag .L29 we perform a check to '-' character, ignoring it in case we found it. Literally jumping to the increment steps.

Now here there's something interesting as well, on tag .L35 we check our counter with 8, in case it's not equal we jump to tag .L43. Which also have several checks on our counter in ebp. The checks can be resumed in this way: if counter is 13, 18 or 23 check for '-' on tag .L29, if counter is 36 end the program. The default case, is just to read another character from our string on tag .L33.

First question that comes to my mind is, why 13, 18 and 23? That question it's easy to answer when you take a look at tag .L34. I'll add it here as well, with some comments. In this part of the code, we make use of strtoul to convert chunks of the string, from hexadecimal string representation to a unsigned long in C. These chunks of the string are divided into 5 ranges, from 0 to 8, from 9 to 13, from 14 to 18, from 19 to 23 and from 24 to 36. The results of these conversions are been stored in r15, r14, r13 and rcx.

;; ANALYZING ON 5 STEPS
.L34:
    ;; rbx from 0 to 36
    ;; ------------------------------------------------------------------------------------------------------------------|
    ;;          8                   4                       4                       4                       12           |
    ;; rbx --- rbx + 8| rbx + 9 ---- rbx + 13 | rbx + 14 ---- rbx + 18 | rbx + 19 ---- rbx + 23 | rbx + 24 ---- rbx + 36 |
    ;; ------------------------------------------------------------------------------------------------------------------|

    ;; convert string in rdi, intial string into number
    mov edx, 16 ;; 3rd argument, base of number to convert
    xor esi, esi ;; 2nd argument, esi it's passed as NULL, we don't need to store the address of the first valid char
    mov rdi, rbx ;; 1st argument
    call    strtoul

    lea rdi, [rbx+9] ;; 1st arg
    mov edx, 16 ;; 3rd arg
    xor esi, esi ;;  2nd arg
    mov DWORD PTR [r15], eax ;; value of number just converted on previous call
    call    strtoul

    lea rdi, [rbx+14] ;; 1st arg
    mov edx, 16 ;; 2nd arg
    xor esi, esi ;; 3rd arg
    mov WORD PTR [r14], ax ;; value of previous
    call    strtoul

    lea rdi, [rbx+19] ;; 1st arg
    mov edx, 16 ;; 2nd arg
    xor esi, esi ;; 3rd arg
    mov WORD PTR [r13+0], ax ;; value of previous call
    call    strtoul

    mov rcx, QWORD PTR [rsp]
    lea rdi, [rbx+24] ;; 1st arg
    mov edx, 16 ;; 2nd arg
    xor esi, esi ;; 3rd arg
    mov WORD PTR [rcx], ax ;; previous call returned
    call    strtoull

    mov rcx, QWORD PTR [rsp+8]
    xor edx, edx ;; goes as 0
    mov QWORD PTR [rcx], rax
    jmp .L28

Flow

Let's put this into a flow diagram, will be easier to understand

Looking at the flowchart, what we have it's easier to understand. We are iterating over the string with this format <8 hex digits>-<4 hex digits>-<4hex digits>-<4 hex digits>-<12 hex digits>. Now we have it!!! This is the format for an uuid, for example 45ab0c9c-873f-422e-963c-27d13c3fdac9.

Formal description

We are checking if the string provided has an uuid format.

Conclusion

Quite interesting how things are implemented in assembly.