{"id":13,"date":"2022-07-17T21:55:13","date_gmt":"2022-07-17T21:55:13","guid":{"rendered":"http:\/\/moveax.me\/?p=13"},"modified":"2022-07-18T00:20:26","modified_gmt":"2022-07-18T00:20:26","slug":"crackme0x01","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x01\/","title":{"rendered":"Crackme0x01 Dissected with Radare2"},"content":{"rendered":"\n

In order to have some insight of what are we dealing with, let\u2019s run the Crackme0x01 program first.<\/p>\n\n\n

\n
\"crackme0x01\"<\/figure>\n<\/div>\n\n\n

Password Challenge! Apparently, its just a simple program that tests a password entered by the user. Let\u2019s dig in, starting Radare2 with analyze and debug options (check Radare Basics<\/a> to find out how).<\/p>\n\n\n\n

Analysis<\/strong><\/h2>\n\n\n\n

So, first thing, let\u2019s look at the functions present in the binary. IMHO, it\u2019s always a good idea take a peek in the program functions with the aim of getting to know the program and its abilities.<\/p>\n\n\n

\n
\"afll\"<\/figure>\n<\/div>\n\n\n

At the address 0x080483e4 we have the main function. We can also see scanf function that will collect our input and the printf function, responsible for printing all the messages.<\/p>\n\n\n\n

If we go ahead and seek to the main function we should notice that the address in the prompt changed.<\/p>\n\n\n\n

Before we jump into the assembly code, let\u2019s take a look at all the strings in this data section and if we are lucky enough, maybe we can see the clear text password.<\/p>\n\n\n

\n
\"iz\"<\/figure>\n<\/div>\n\n\n

No luck today\u2026<\/p>\n\n\n

\n
\"pdf\"<\/figure>\n<\/div>\n\n\n

Let\u2019s see the code in the main function.<\/p>\n\n\n\n

We can identify where each one of the strings is being printed, as well as the call to the scanf function. We can also see a compare instruction which seems a good place to start.<\/p>\n\n\n\n

Obviously the result of this instruction must me true, because if it isn\u2019t, the flow of this program will lead to a \u201cInvalid Password\u201d string and that\u2019s definitely what we don\u2019t want. Stripping this instruction apart, we\u2019ve got a local variable (local_4h) and a value. The variable must be the place where the input collected was stored and the value must be the solution! Notice that the value is represented in hexadecimal and the program will most likely accept base 10 input aka decimal. Let\u2019s first convert the value and then confirm if 0x149a is the solution.<\/p>\n\n\n\n

Solution for Crackme0x01<\/strong><\/h2>\n\n\n
\n
\"Solution\"<\/figure>\n<\/div>\n\n\n

Yep! 5274 is the solution for Crackme0x01, the magic password. Be aware that I could play with the instructions, changing the jump instruction to an unconditional jump in order to accept any value\/password or even replace that value in the compare instruction but let\u2019s leave that for another exercise. Honestly, I only know how to replace that value for another value, but I don\u2019t know how to replace it with a string. YET \ud83d\ude42<\/p>\n\n\n\n

Check the walkthrough video for this exercise.<\/p>\n","protected":false},"excerpt":{"rendered":"

In order to have some insight of what are we dealing with, let\u2019s run the Crackme0x01 program first. Password Challenge! Apparently, its just a simple…<\/p>\n

Continue readingCrackme0x01 Dissected with Radare2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,1],"tags":[],"class_list":["post-13","post","type-post","status-publish","format-standard","hentry","category-radare2","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/13","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=13"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/13\/revisions"}],"predecessor-version":[{"id":24,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/13\/revisions\/24"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=13"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=13"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=13"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}