[Binary Bomb – Phase 4

I hope it’s obvious that phase4 is checking that the first number is in the range 0..14 inclusive (see lines +44..+57) Then it invokes func4 with three arguments: the first number entered, 0 and 14 (lines +62..+85). Next it checks that the return value is 0x25 (37 decimal) on line +90 and that the second … Read more

JNZ & CMP Assembly Instructions

JNZ is short for “Jump if not zero (ZF = 0)”, and NOT “Jump if the ZF is set”. If it’s any easier to remember, consider that JNZ and JNE (jump if not equal) are equivalent. Therefore, when you’re doing cmp al, 47 and the content of AL is equal to 47, the ZF is set, ergo the jump (if Not … Read more

Is there a C++ decompiler?

You can use IDA Pro by Hex-Rays. You will usually not get good C++ out of a binary unless you compiled in debugging information. Prepare to spend a lot of manual labor reversing the code. If you didn’t strip the binaries there is some hope as IDA Pro can produce C-alike code for you to work with. Usually it is … Read more