{"id":17,"date":"2022-07-17T21:56:11","date_gmt":"2022-07-17T21:56:11","guid":{"rendered":"http:\/\/moveax.me\/?p=17"},"modified":"2022-07-17T22:15:24","modified_gmt":"2022-07-17T22:15:24","slug":"crackme0x03-dissected-with-radare2","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x03-dissected-with-radare2\/","title":{"rendered":"Crackme0x03 Dissected with Radare2"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Crackme0x03 is the first of this series of exercises to have more that one function. It actually has three (important) functions, described below:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>main function, where the core code is<\/li><li>test function, which tests our input and decides the flow of the program<\/li><li>shift function, responsible for decrypt the string<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Getting the&nbsp;Crackme0x03&nbsp;password through analysis<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">From now on, I\u2019ll jump the part where I check what the program does, because they all test a string\/value.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, let\u2019s check the functions in this program.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/01\/afll-1.png\" alt=\"afll for crackme0x03\" class=\"wp-image-197\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Let me give you some insight of all the functions and disclose the solution for this crackme along the way.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>The main<\/strong><\/li><\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/01\/main.png\" alt=\"main\" class=\"wp-image-205\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">This main function starts to print some strings to guide the user and then, asks for a password. This section of code is very similarly to the one in the&nbsp;<a href=\"crackme0x02\/\">crackme0x02<\/a>&nbsp;until instruction&nbsp;<em>mov eax, dword[local_ch]<\/em>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Solution<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">As you can imagine, the solution is the same for both of this exercises, but you can confirm it executing the program (obviously) or setting a breakpoint after the imul instruction.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From this point forward, it\u2019s all about saving to the stack the value that the user provided and the result of all this calculations. This values are the parameters for the next function.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>The test<\/strong><\/li><\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/01\/test.png\" alt=\"test\" class=\"wp-image-206\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The values in the stack are now arg_8h and arg_ch. arg_8h has the input provided by the user and arg_ch has the result of a series of calculations. As one could expect, arg_ch has the solution for this crackme.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After the jump instruction, the stack holds an encrypted string. Well, the result of the compare instruction seems to determine which string will be saved, so we can assume that the strings are \u201cInvalid Password\u201d and \u201cPassword OK\u201d like the previous exercises.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At this point, we could try to use an online decipher service. I\u2019m sure it would give us the correct answer and save us trouble of looking into the next function. But hey, let\u2019s not spare us all that fun!<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>The shift<\/strong><\/li><\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/01\/shift.png\" alt=\"shift\" class=\"wp-image-209\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">This one took me a a minute to understand. local_7ch, arg_8h and local_78h are variables. The first is just a counter&nbsp; that ensures the termination of the program the moment that string is deciphered. The second holds the original encrypted string. The third and last, has the deciphered string.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To be brief, this function takes an encrypted string as parameter and deciphers it, char by char. The string was coded by a&nbsp;<a href=\"https:\/\/en.wikipedia.org\/wiki\/Caesar_cipher\">Caesar cipher<\/a>, so this function just reverts that process. If you take a closer look and debug this function, you\u2019ll notice that the cipher is shift (how convenient!) by 3, caused by the instruction \u201c<em>sub al, 3<\/em>\u201c.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next post that I\u2019ll make will be about the Radare2\u2019s Visual mode and I\u2019ll use this crackme to introduce it. In that video I\u2019ll dissect this shift function.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Getting the&nbsp;Crackme0x03&nbsp;password through program modification<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In the last exercise I overwritten the jump instruction with a&nbsp;<em>nop<\/em>&nbsp;so that the program can accept any password. This time, I\u2019m going a little further an replace that instruction by a unconditional jump. This has to be done in the test function, because that\u2019s where the comparison occurs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now,&nbsp;<em>wa jmp 0x804848a @ 0x0804847a<\/em>&nbsp;is the command to type.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/01\/wa.png\" alt=\"wa\" class=\"wp-image-212\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Everything looks ok, so let\u2019s check it.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/01\/run-2.png\" alt=\"Crackme0x03 cracked\" class=\"wp-image-213\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Done!<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Walkthrough video<\/strong><\/h4>\n","protected":false},"excerpt":{"rendered":"<p>Crackme0x03 is the first of this series of exercises to have more that one function. It actually has three (important) functions, described below: main function,&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x03-dissected-with-radare2\/\">Continue reading<span class=\"screen-reader-text\">Crackme0x03 Dissected with Radare2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,1],"tags":[],"class_list":["post-17","post","type-post","status-publish","format-standard","hentry","category-radare2","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/17","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=17"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/17\/revisions"}],"predecessor-version":[{"id":22,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/17\/revisions\/22"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=17"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=17"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}