Understanding OpenSSL's Assembly version of AES decryption implementation - c

Question

I am trying to understand how OpenSSL implemented AES decryption using Assembly language and for the same I am using gdb debugger.
To understand from very basic concept how AES works - like Byte Substitute, Mix Columns OR how lookup table operations are performed. I am using very old version of OpenSSL-0.9.8.a as it contains only one assembly file ax86-elf.s ( generated from aes-586.pl) whereas latest Openssl contains multiple files (supporting AES-NI, SSE etc).
After understanding with Old OpenSSL, I may try to look into latest OpenSSL version.
Here is what I have done so far.
Generated assembly code of ax86-elf.s can be found here
https://pastebin.com/L3FsbqmK
It has global label AES_Td which points to some long data. I think those long data is the AES look up table data.
.globl AES_Td
.text
.globl _x86_AES_decrypt
.type _x86_AES_decrypt,#function
.align 16
_x86_AES_decrypt:
movl %edi, 12(%esp)
...
...
.align 64
AES_Td:
.long 1353184337,1353184337
.long 1399144830,1399144830
.long 3282310938,3282310938
.long 2522752826,2522752826
.long 3412831035,3412831035
.long 4047871263,4047871263
.long 2874735276,2874735276
.long 2466505547,2466505547
.long 1442459680,1442459680
To debug openssl, I have used gdb.
gdb /usr/local/ssl/bin/openssl
(gdb) set args enc -d -aes-128-cbc -in ciphertext2.bin -out plaintext2.txt -K 0123456789abcdef0123456789abcdef -iv 00000000000000000000000000000000
(gdb) set logging on
Copying output to gdb.txt.
(gdb) b main
Breakpoint 1 at 0x8055591
(gdb) b _x86_AES_decrypt
Function "_x86_AES_decrypt" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
(gdb) run
Starting program: /usr/local/ssl/bin/openssl enc -d -aes-128-cbc -in ciphertext2.bin -out plaintext2.txt -K 0123456789abcdef0123456789abcdef -iv 00000000000000000000000000000000
Breakpoint 1, 0x08055591 in main ()
(gdb) s
Single stepping until exit from function main,
which has no line number information.
__GI_getenv (name=0x8090a32 "OPENSSL_DEBUG_MEMORY") at getenv.c:35
35 getenv.c: No such file or directory.
(gdb)
__x86.get_pc_thunk.bx () at ../sysdeps/i386/i686/multiarch/strcat.S:55
55 ../sysdeps/i386/i686/multiarch/strcat.S: No such file or directory.
(gdb)
__GI_getenv (name=0x8090a32 "OPENSSL_DEBUG_MEMORY") at getenv.c:36
36 getenv.c: No such file or directory.
(gdb)
__strlen_ia32 () at ../sysdeps/i386/i686/multiarch/../../i586/strlen.S:43
43 ../sysdeps/i386/i686/multiarch/../../i586/strlen.S: No such file or directory.
Now this shows getenv.c is called, then ../sysdeps/i386/i686/multiarch/../../i586/strlen.S is called (although I am not able to view source code due to non-availablity).
I am wondering this way I would be able to understand the code as it shows so many calls of functions whose source code is not available.
So I follow this second approach, without putting any break-point at main.
gdb /usr/local/ssl/bin/openssl
(gdb) set args enc -d -aes-128-cbc -in ciphertext2.bin -out plaintext2.txt -K 0123456789abcdef0123456789abcdef -iv 00000000000000000000000000000000
(gdb) set logging on
Copying output to gdb.txt.
(gdb) b _x86_AES_decrypt
Function "_x86_AES_decrypt" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (_x86_AES_decrypt) pending.
(gdb) run
Starting program: /usr/local/ssl/bin/openssl enc -d -aes-128-cbc -in ciphertext2.bin -out plaintext2.txt -K 0123456789abcdef0123456789abcdef -iv 00000000000000000000000000000000
Breakpoint 1, 0xb7e57590 in _x86_AES_decrypt ()
from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb) s
Single stepping until exit from function _x86_AES_decrypt,
which has no line number information.
0xb7e586d0 in AES_cbc_encrypt () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb) s
Single stepping until exit from function AES_cbc_encrypt,
which has no line number information.
Breakpoint 1, 0xb7e57590 in _x86_AES_decrypt ()
from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
(gdb)
Single stepping until exit from function _x86_AES_decrypt,
which has no line number information.
0xb7e586d0 in AES_cbc_encrypt () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
Single stepping until exit from function AES_cbc_encrypt,
which has no line number information.
0xb7ea380e in aes_128_cbc_cipher () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
Single stepping until exit from function aes_128_cbc_cipher,
which has no line number information.
0xb7ea182d in EVP_EncryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
Single stepping until exit from function EVP_EncryptUpdate,
which has no line number information.
0xb7ea1a39 in EVP_DecryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
Single stepping until exit from function EVP_DecryptUpdate,
which has no line number information.
__memcpy_ssse3_rep () at ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S:111
111 ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S: No such file or directory.
I have following doubts -
I am not able to understand where AES LOOKUP table operations are performed ? How to find them ?
Why AES_cbc_encrypt, EVP_EncryptUpdate functions are called although I am performing decryption operations?
How to debug functions EVP_DecryptUpdate() to understand how the function is executed ? Simply putting breakpoint at the function like b EVP_DecryptUpdate is not giving any insight.
Here is what I am getting while putting breakpoint
(gdb) b EVP_DecryptUpdate
Breakpoint 3 at 0xb7ea19e0
(gdb) run
Breakpoint 3, 0xb7ea19e0 in EVP_DecryptUpdate ()
from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb) si
0xb7ea19e1 in EVP_DecryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb) si
0xb7ea19e2 in EVP_DecryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
0xb7ea19e3 in EVP_DecryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
0xb7ea19e4 in EVP_DecryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
0xb7e372c0 in __x86.get_pc_thunk.bx ()
from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
0xb7e372c3 in __x86.get_pc_thunk.bx ()
from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
0xb7ea19e9 in EVP_DecryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
0xb7ea19ef in EVP_DecryptUpdate () from /usr/local/ssl/lib/libcrypto.so.0.9.8
(gdb)
EVP_DecryptUpdate() function is defined inside crypto/evp/evp_enc.c
int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
const unsigned char *in, int inl)
{
How to display the corresponding C instructions while debugging using gdb ?
I am not sure, but it may be possible OpenSSL use various C programs as well as assembly to decrypt the AES encrypted ciphertext. How to find the flow of evaluation ?
I am using Debian linux, 32bit, gdb .
Any help to understand the above flow or any link to understand will be a great help. Thanks in advance.