{"id":30,"date":"2022-07-17T21:59:47","date_gmt":"2022-07-17T21:59:47","guid":{"rendered":"http:\/\/moveax.me\/?p=30"},"modified":"2022-08-31T19:02:32","modified_gmt":"2022-08-31T19:02:32","slug":"crackme0x05-dissected-with-radare2","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x05-dissected-with-radare2\/","title":{"rendered":"Crackme0x05 Dissected with Radare2"},"content":{"rendered":"\n

When I started writing this posts about radare2, I was expecting to learn how to work with this tool. That was the objective and what drove me to start this blog. What I was not expecting, was to learn something about Assembly. Crackme0x05 is the first from this series of exercises that made learn a new instruction. GREAT!!!<\/p>\n\n\n\n

Getting the Crackme0x05 password through analysis<\/strong><\/h3>\n\n\n\n

Just like Crackme0x04<\/a>, this crackme has multiple solutions. Also, it has multiple functions. Let\u2019s start digging.<\/p>\n\n\n

\n
\"afll\"<\/figure>\n<\/div>\n\n\n

We\u2019ve got a new function: parell.<\/p>\n\n\n\n

The main function seems to be the same, then I won\u2019t go through it. Check function, at the first sight, has the same code as the previous exercise, the only thing that has changed is the result of the sum. Let\u2019s see.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Instead of being 15, the result of the sum must be 16. At this point, I was like \u201cReally?! It\u2019s just this???\u201d. So I ran the program and the result was not quite what I expect\u2026<\/p>\n\n\n

\n
\"Not<\/figure>\n<\/div>\n\n\n

This is good news. It means that this crackme it\u2019s not as simple as I expected. In fact, if at some point the variable local_8h holds 0x10 (16 in decimal) we will be \u201credirect\u201d to parell function. So, the only answer is that parell make some calculations itself. Time to check it.<\/p>\n\n\n

\n
\"parell\"<\/figure>\n<\/div>\n\n\n

We can see the whole input being passed to sscanf function.  If you put a breakpoint right after the sscanf call, you\u2019ll see that local_4h holds our input converted to hexadecimal.<\/p>\n\n\n\n

The and<\/em> & test<\/em><\/strong><\/h3>\n\n\n\n

For those who are not used to Assembly, the next 3 lines can be confusing. First, we\u2019ve got an and<\/em>. Roughly speaking, the and<\/em> operation returns 1 if the matching bits in both operands is 1, otherwise it will return 0. The result will be saved in the first operand. Let me give you an example.<\/p>\n\n\n\n

Imagine that you have the instruction \u201cand eax, 0x7\u201d, where eax holds 0xd. After this instruction, eax will hold 0x5.<\/p>\n\n\n

\n
\"and<\/figure>\n<\/div>\n\n\n

Now, imagine you want to clear the register. You can just use the instruction \u201cand eax, 0\u201d.<\/p>\n\n\n\n

In our case, we have a 1 as a second operator, so everything will be zero except the least significant bit. This tell us if we are dealing with a even or odd number, but let\u2019s move on.<\/p>\n\n\n\n

Second operation is a test<\/em><\/a>. Let me just take a break to tell you that I\u2019ve neither knew what was the purpose of this instruction nor I used it before. So this just became a great opportunity to learn it.<\/p>\n\n\n\n

So, for starters, the test<\/em> operation is very similar to and<\/em>, except this last one writes the result to the first operand. test<\/em> operation performs a bitwise and<\/em> but the result of the operation is discarded. It only modifies the SF, ZF and PF flags. In this case, only ZF (zero flag) matters. If the zero flag is set, then the flow of the program will continue. Otherwise, and due to the jne instruction, the program will terminate this function. Bear in mind that je is an alias to jz and jne an alias to jnz.<\/p>\n\n\n\n

This means that if the zero flag is set, the string \u201cPassword OK\u201d will be printed!<\/p>\n\n\n\n

Did you get it all?<\/p>\n\n\n\n

Solution<\/strong><\/h3>\n\n\n\n

Crackme0x05 asks for a password to the user. That password must be a number, where the sum from the left to the right sums to 0x10 (16 in decimal) to pass in the first condition. Note that the sum of all digits doesn\u2019t need to result in 0x10. It also needs to be an even number in order to pass the second condition inside parell function.<\/p>\n\n\n\n

Modifying Crackme0x05 to accept any password<\/strong><\/h3>\n\n\n\n

To make this program accept any password, we could put an unconditional jump to the string \u201cPassword OK\u201d, right after the compare instruction in the check function. But let\u2019s go a little further.<\/p>\n\n\n\n

We\u2019re going to need to modify the program in two points because, two conditions must be met in order to obtain the \u201cPassword OK\u201d.<\/p>\n\n\n\n

So, first let\u2019s overwrite the the first jump to the string \u201cPassword Incorrect\u201d and replace it with a nop.<\/p>\n\n\n\n

\"check
Check function modification<\/figcaption><\/figure>\n\n\n\n

At this point, all the even numbers inserted will lead to \u201cPassword OK\u201d.<\/p>\n\n\n\n

Second, let\u2019s be lazy and change just the and<\/em> operation. Using the and<\/em> operator with a zero as a second operand will make the eax register be zero as well. This will set the zero flag and make the program print \u201cPassword OK\u201d.<\/p>\n\n\n\n

\"parell
Parell function modification<\/figcaption><\/figure>\n\n\n\n

Let\u2019s check if that worked.<\/p>\n\n\n

\n
\"cracking<\/figure>\n<\/div>\n\n\n

Cracked! \ud83d\ude42<\/p>\n\n\n\n

Do you have another solution? Drop me a comment!<\/p>\n\n\n\n

Walkthrough video<\/strong><\/h4>\n","protected":false},"excerpt":{"rendered":"

When I started writing this posts about radare2, I was expecting to learn how to work with this tool. That was the objective and what…<\/p>\n

Continue readingCrackme0x05 Dissected with Radare2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,1],"tags":[],"class_list":["post-30","post","type-post","status-publish","format-standard","hentry","category-radare2","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/30","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=30"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/30\/revisions"}],"predecessor-version":[{"id":123,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/30\/revisions\/123"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=30"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=30"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=30"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}