{"id":34,"date":"2022-07-17T22:00:24","date_gmt":"2022-07-17T22:00:24","guid":{"rendered":"http:\/\/moveax.me\/?p=34"},"modified":"2022-08-31T19:02:40","modified_gmt":"2022-08-31T19:02:40","slug":"crackme0x07-dissected-with-radare2","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x07-dissected-with-radare2\/","title":{"rendered":"Crackme0x07 Dissected with Radare2"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Crackme0x07 is the exercise of this week. New tricks are used to make our task more difficult. This tricks includes function names identical to native functions. Let\u2019s see.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Getting the&nbsp;Crackme0x07&nbsp;password through analysis<\/strong><\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/afll-1.png\" alt=\"afll of crackme0x07\" class=\"wp-image-334\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Those functions in purple are the ones that need our attention.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s now \u201cdivide and conquer\u201d\u2026<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><em><strong>sub.LOLO_4b4<\/strong><\/em><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Just like the&nbsp;<a href=\"crackme0x06\">previous exercise<\/a>, this one requires an environment variable \u201cLOL\u201d in order to obtain the \u201cPassword OK\u201d. This function is responsible for checking if that variable exists. The code is very similar to&nbsp;<em>sym.dummy<\/em>&nbsp;from the last crackme.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><em><strong>sub.Password_Incorrect__n_524<\/strong><\/em><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This one just prints the \u201cPassword Incorrect\u201d and exits the program. We definitely don\u2019t want to execute this function \ud83d\ude42<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><em><strong>sub.sscanf_542<\/strong><\/em><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The name of this function is very alike to the native function&nbsp;<em>sscanf<\/em>. Aside that, it will convert the number provided by you to an integer because, as you know, the input provided to the program is a set of ASCII characters.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next, it will call&nbsp;<em>sub.LOLO_4b4<\/em>&nbsp;and it will also print the \u201cPassword OK!\u201d if all conditions are met.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">About the last function, let me take a short break to explain something. During the past week, I read a few posts (I always do, to ensure that I\u2019m not forgetting anything) explaining that the following section of code tests the size of your input and if has more than 9 digits, you will fail.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/test.png\" alt=\"test eax\" class=\"wp-image-338\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Let me go ahead and tell you that this is NOT true! This section of code checks if the number provided is even, but you could believe that this portion of code checks if the length of your number is greater than 9 and let me tell you why.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you notice,&nbsp;<em>sscanf<\/em>&nbsp;will return an integer. The range of this&nbsp;<a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/s3f49ktz.aspx\">data type<\/a>&nbsp;is from -2,147,483,648 to 2,147,483,647. So, as you can imagine, the greater number that you can provide is 2,147,299,998 which has 10 digits, and still obtain the \u201cPassword OK!\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now that this issue is clarified, let\u2019s move on.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><em><strong>sub.strlen_5b9<\/strong><\/em><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Again, the name of this function is very similar to the native function&nbsp;<em>strlen<\/em>. But this function, tests if the sum of the digits (from your input) from left to right, at any point, results in 0x10 (16 in decimal). This is not something new. It also calls&nbsp;<em>sub.sscanf_542<\/em>&nbsp;and&nbsp;<em>sub.Password_Incorrect__n_524<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the end of the function, we can see instructions to print a \u201cwtf\u201d string. For now, I think it\u2019s just a decoy, because this section of code won\u2019t be executed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Solution<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Again, to solve the crackme0x07 the following conditions must be met:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>We must sum the digits of the number provided, from the left to right, until we get 0x10<\/li><li>We must set the environment variable LOL<\/li><li>The number must be even<\/li><li>The number must be less or equal than 2,147,299,998<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Modifying&nbsp;<\/strong><strong>Crackme0x07&nbsp;to accept any password<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s be SUPER lazy and make just one modification, so this program can accept anything.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s make this crackme collect our input and jump right to \u201cPassword OK!\u201d.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/result-1.png\" alt=\"Cracking crackme0x07\" class=\"wp-image-341\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">And now, let\u2019s see if it worked\u2026<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/done.png\" alt=\"result\" class=\"wp-image-342\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Done! No environment variable need!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How did you do it?<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Walkthrough video<\/strong><\/h4>\n","protected":false},"excerpt":{"rendered":"<p>Crackme0x07 is the exercise of this week. New tricks are used to make our task more difficult. This tricks includes function names identical to native&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x07-dissected-with-radare2\/\">Continue reading<span class=\"screen-reader-text\">Crackme0x07 Dissected with Radare2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,1],"tags":[],"class_list":["post-34","post","type-post","status-publish","format-standard","hentry","category-radare2","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/34","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=34"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/34\/revisions"}],"predecessor-version":[{"id":125,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/34\/revisions\/125"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=34"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=34"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=34"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}