{"id":32,"date":"2022-07-17T22:00:07","date_gmt":"2022-07-17T22:00:07","guid":{"rendered":"http:\/\/moveax.me\/?p=32"},"modified":"2022-08-31T19:02:36","modified_gmt":"2022-08-31T19:02:36","slug":"crackme0x06-dissected-with-radare2","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x06-dissected-with-radare2\/","title":{"rendered":"Crackme0x06 Dissected with Radare2"},"content":{"rendered":"\n

Crackme0x06! A new exercise, a new function. Also, some new tricks are used to obtain the so wanted \u201cPassword OK\u201d.<\/p>\n\n\n\n

This exercise is very alike the previous<\/a> one, so I won\u2019t go through the functions already explained.<\/p>\n\n\n\n

Getting the Crackme0x06 password through analysis<\/strong><\/h3>\n\n\n\n

As usual, let\u2019s check the functions available.<\/p>\n\n\n\n

We\u2019ve got a new function: dummy.<\/p>\n\n\n\n

One of the conditions that we saw before, must be met if we want to jump to this function, we need to sum from left to right until we get 0x10 (16 in decimal). If this condition is met, we are on the right path, and will go to dummy function.<\/p>\n\n\n\n

Let\u2019s take a peek into this function.<\/p>\n\n\n\n

There\u2019s a lot going on here. This (not so) dummy function messed up my brain with all those \u201ceax*4\u201d.<\/p>\n\n\n\n

Before we continue, let me show you something that I saw when I started debugging this function.<\/p>\n\n\n\n

LS_COLORS?! Are we painting now???<\/strong><\/h3>\n\n\n\n

I didn\u2019t know what to expect at this point, so I googled for this, and ended up finding that this is an environment variable\u2026<\/p>\n\n\n\n

So you can follow my explanation, let me go ahead and tell you that this function looks for something in your environment variables, looping through all of them.<\/p>\n\n\n\n

Moving on, at the beginning of this function, we see a reset to the local_4h, which is an index.<\/p>\n\n\n\n

The next few instructions until the compare, ensures that you get an \u201cInvalid password\u201d if all the environment variables are compared and the desired on is not found. arg_ch as you\u2019ve seen, holds a pointer to the first environment variable.<\/p>\n\n\n\n

Pay attention to the manipulation of ecx<\/em> and edx<\/em> registers, at 0x080484d7 address and the next one. ecx<\/em> will hold the step that will be used to jump to the next environment variable. edx<\/em> has a copy of the address where the first environment variable is located.<\/p>\n\n\n\n

The way used to iterate over all the environment variables is a sum between these two registers as you can see at 0x080484f6 address.<\/p>\n\n\n\n\n\n

This is what happens. edx is \u201cthe same\u201d as arg_ch and ecx represents each box of the middle column, where each box has a size of 4 bytes (that eax*4<\/strong>) and holds the address of each environment variable.<\/p>\n\n\n\n

Now, we see a 3 being moved to local_8h and the string \u201cLOLO\u201d being loaded to local_4h_2 and after that, we see a strncmp. This strncmp<\/a> function takes three arguments: two strings and the size. Obviously, the 3 is the size and the \u201cLOLO\u201d is one of the two string. The last string is the environment variable. Notice that only three characters will be compared, so you\u2019ll be actually comparing \u201cLOL\u201d with something. The following test instruction is easy, because strncmp returns 0 if (in this case) the first 3 bytes of both strings match.<\/p>\n\n\n\n

In that case, we\u2019ll leave the function with 1 loaded into the eax register.<\/p>\n\n\n\n

Returning to parell function, and as crackme0x05, we will check if the number provided is even.<\/p>\n\n\n\n

Solution<\/strong><\/h3>\n\n\n\n

To solve crackme0x06 exercise the following conditions must be met:<\/p>\n\n\n\n