![\"crackme0x02\"](\"wp-content\/uploads\/2018\/01\/crackme0x02.png\")
<\/figure>\n<\/div>\n\n\nLet\u2019s start and first of all, we need to run the program. <\/p>\n\n\n\n
Like the previous exercise<\/a>, this one is a password challenge.<\/p>\n\n\n\n To start debugging this program we need to start Radare with the flags A<\/em> and d<\/em>. Then, we can check the strings present in data section.<\/p>\n\n\n None of this strings seems to be useful, so if we check the functions present in this binary we can see the main function that we can seek to. Let\u2019s print the main.<\/p>\n\n\n Similarly to the previous exercise, the string printed is determine by a compare intruction. Between the scanf instruction and this compare instruction we can see some operations taking place, including one sum and one multiplication. Now, it\u2019s time to dissect that part of the code using breakpoints.<\/p>\n\n\n\n We can see the local variable local_8h holding 0x5a value and local_ch holding 0x1ec, but let\u2019s use afvd to confirm. For that, we need to set a breakpoint right after this last instruction, at 0x08048439 address.<\/p>\n\n\n\n After set a breakpoint we can see it in front of that address, using pdf. Then, use dc to run the program until it hits the breakpoint.<\/p>\n\n\n Yes, local_8h and local_ch hold those values.<\/p>\n\n\n\n The next instruction puts the value of local_ch in the edx register. Notice that this doesn\u2019t happen for local_8h. Instead, eax loads the address of this variable using lea operator which means that eax will \u201cpoint\u201d to local_8h memory address.<\/p>\n\n\n\n From this point forward, the operations to calculate the solution are taking place.<\/p>\n\n\n\n The next instruction adds the value of edx to the value of the memory cell to where eax points to, and stores it in that same address. The value of local_ch (0x1ec) was added to local_8h (0x5a) and stored in local_8h.<\/p>\n\n\n\n Let\u2019s check the contents of all variables again.<\/p>\n\n\n So far, so good. Next, the value stored in local_8h is moved to eax register. At this point, both local_8h and register eax holds the value 0x246, so the next imul instruction will raise this value to the power 2. eax register should now have the value 0x52b24. Let\u2019s confirm using dr command.<\/p>\n\n\n There it is! The next two instructions will prepare the registers and variables for the cmp instruction. So, local_ch now have the solution to this challenge and eax holds the value inserted by the user (which was stored in local_4h).<\/p>\n\n\n\n We now know that the solution for this crackme must be 0x52b24 (or 338724 in decimal). Let\u2019s check.<\/p>\n\n\n We\u2019ve got it right!<\/p>\n\n\n\n Time for the hard part. Before I continue, let me just state that I could manipulate the code in many ways and obtain an identical result. For instance, I could replace the compare instruction by cmp<\/em> eax, eax for example or I could edit the opcode before the compare instruction and save some value in eax register.<\/p>\n\n\n\n Instead, I going to overwrite the jump instruction right after the compare instruction and replace it with a nop by changing the opcodes.<\/p>\n\n\n\n For more information about the opcodes, I advise you to take a look in this website<\/a> and this one<\/a>.<\/p>\n\n\n\n Now, if we going to modify the program we need to open it in write mode (with the w flag). Don\u2019t forget A flag as well. After that, you still need seek to the main function.<\/p>\n\n\n\n So, the target operation is at 0x08048451 address. To replace it let\u2019s use wx command. By the way, the 90 that you see in the image below is the opcode for the nop operation<\/p>\n\n\n If the second operation is difficult to understand, check the walkthrough video at the end of this post.<\/p>\n\n\n\n The next image is just a portion of pdf command. It\u2019s possible to see that the jump operation has been replaced.<\/p>\n\n\n Just to be crystal clear, it doesn\u2019t matter the value of eax nor local_ch because no action will take place after the compare instruction.<\/p>\n\n\n\n Finally, let\u2019s run crackme0x02 and check if we\u2019re good.<\/p>\n\n\n Mission Accomplished For the Crackme0x02, I\u2019ll follow two approaches. First, I\u2019m going to find out the password through analysis. Then, I\u2019ll modify the program in order to…<\/p>\nGetting the Crackme0x02 password through analysis<\/strong><\/h3>\n\n\n\n
![\"iz\"](\"wp-content\/uploads\/2018\/01\/iz.png\")
<\/figure>\n<\/div>\n\n\n![\"pdf\"](\"wp-content\/uploads\/2018\/01\/pdf.png\")
<\/figure>\n<\/div>\n\n\n![\"afvd\"](\"wp-content\/uploads\/2018\/01\/afvd-Copy.png\")
<\/figure>\n<\/div>\n\n\nSolution<\/strong><\/h4>\n\n\n\n
![\"afvd2\"](\"wp-content\/uploads\/2018\/01\/afvd2.png\")
<\/figure>\n<\/div>\n\n\n![\"\"](\"wp-content\/uploads\/2018\/01\/dr.png\")
<\/figure>\n<\/div>\n\n\n![\"Solution\"](\"wp-content\/uploads\/2018\/01\/solution.png\")
<\/figure>\n<\/div>\n\n\nGetting the Crackme0x02 password through program modification<\/strong><\/h3>\n\n\n\n
![\"<span](\"wp-content\/uploads\/2018\/01\/write.png\")
<\/figure>\n<\/div>\n\n\n![\"pdf\"](\"wp-content\/uploads\/2018\/01\/pdf-1.png\")
<\/figure>\n<\/div>\n\n\n![\"result\"](\"wp-content\/uploads\/2018\/01\/result.png\")
<\/figure>\n<\/div>\n\n\n![\"\ud83d\ude4c\"](\"https:\/\/s.w.org\/images\/core\/emoji\/13.0.0\/svg\/1f64c.svg\")
<\/p>\n\n\n\nWalkthrough video<\/strong><\/h4>\n","protected":false},"excerpt":{"rendered":"