{"id":38,"date":"2022-07-17T22:01:03","date_gmt":"2022-07-17T22:01:03","guid":{"rendered":"http:\/\/moveax.me\/?p=38"},"modified":"2022-08-31T19:02:45","modified_gmt":"2022-08-31T19:02:45","slug":"crackme0x09-dissected-with-radare2","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x09-dissected-with-radare2\/","title":{"rendered":"Crackme0x09 Dissected with Radare2"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">When we check the available functions, we\u2019re able to notice that the names have changed again, as they are similar to the native functions.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/afll-3.png\" alt=\"afll for crackme0x09\" class=\"wp-image-391\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Another detail is that there are no strings visible in the code. Although, we can see there are strings in this little program if we list them all.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/iz.png\" alt=\"iz\" class=\"wp-image-392\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">So, how are they being printed???<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the code wasn\u2019t the same as Crackme0x08, this little trick could have been more difficult to spot. We can only identify strings being printed because of the call to the printf function (the native one). Before of those calls, we always see an address being loaded to EAX register, and then passed to the printf function&nbsp;throughout&nbsp;the stack. Also, we always see a numeric value being subtracted to EBX register, which means that EBX is used as a base pointer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the beginning of every function we see a call to fcn.08048766 function, which changes the value of EBX. So after that call, EBX will have the base value from where will be calculated all the addresses that contains our strings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let me now guide you step by step so you can understand where the strings are located. Let\u2019s start with sub.strlen_616 function.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>sub.strlen_616<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This function corresponds to sym.check, from the previous exercise.<br>Here we see two printf calls and the base value of EBX, after the changes at the beginning of this function occur, is 0x08049ff4.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/1st-string-strlen.png\" alt=\"%d string\" class=\"wp-image-394\"\/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\"><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x17a2 = 0x08048852<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we check what\u2019s in that address, using&nbsp;<em>pf<\/em>&nbsp;command, we get the following output.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/pf_z2.png\" alt=\"pf z\" class=\"wp-image-396\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">As you should remember,&nbsp;<em>%d<\/em>&nbsp;is a format that will be passed to the sscanf native function. Let\u2019s see the next string.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/2nd-string-strlen.png\" alt=\"wtf\" class=\"wp-image-397\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x1791 = 0x08048863 =&gt;&nbsp;<strong>wtf?<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>sub.printf_55d<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This function corresponds to sym.che, from the previous exercise.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/1st-string-printf.png\" alt=\"Password Incorrect\" class=\"wp-image-398\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x17b7 = 0x0804883d =&gt;&nbsp;<strong>Password Incorrect!<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>sub.sscanf_589<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This function corresponds to sym.parell, from the previous exercise.<br>The first string is already translated. It\u2019s the&nbsp;<em>%d<\/em>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/1st-string-sscanf.png\" alt=\"Password OK!\" class=\"wp-image-402\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x179f = 0x08048855 =&gt;&nbsp;<strong>Password OK!<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>sub.strncmp_4d4<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This function corresponds to sym.dummy, from the previous exercise.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/1st-string-strncmp.png\" alt=\"LOLO\" class=\"wp-image-403\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x17bc = 0x08048838 =&gt;&nbsp;<strong>LOLO<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To finish this translation, let\u2019s also do this for the strings in the main function.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>main<\/strong><\/li><\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/1st-string-main.png\" alt=\"\" class=\"wp-image-404\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x178b = 0x08048869 =&gt;&nbsp;<strong>IOLI Crackme Level 0x09<\/strong><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/2nd-string-main-1.png\" alt=\"\" class=\"wp-image-406\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x1772 = 0x08048882 =&gt;&nbsp;<strong>Password:<\/strong><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignleft\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/3rd-string-main.png\" alt=\"\" class=\"wp-image-407\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">0x08049ff4 \u2013 0x1767 = 0x0804888d =&gt;&nbsp;<strong>%s<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can confirm all the addresses in the second image of this post, the one that corresponds to&nbsp;<em>iz<\/em>&nbsp;command.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Solution<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">And again, the solution for crackme0x09 is this set of conditions:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>We must sum the digits of the number provided, from the left to right, until we get 0x10<\/li><li>We must set the environment variable LOL<\/li><li>The number must be even<\/li><li>The number must be less or equal than 2,147,299,998<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Modifying&nbsp;<\/strong><strong>Crackme0x09&nbsp;to accept any password<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once more, I\u2019m going to be super lazy and make the program jump right to the \u201cPassword OK!\u201d after&nbsp;receiving&nbsp;the input. Let\u2019s do it.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/result-3.png\" alt=\"Result of Crackme0x09\" class=\"wp-image-421\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">That address right after the unconditional jump is the first instruction to print the \u201cPassword OK!\u201d.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/result2.png\" alt=\"Password OK code\" class=\"wp-image-422\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Time to see if that worked.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/02\/run.png\" alt=\"Solving Crackme0x09\" class=\"wp-image-424\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Done!<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Walkthrough video<\/strong><\/h4>\n","protected":false},"excerpt":{"rendered":"<p>When we check the available functions, we\u2019re able to notice that the names have changed again, as they are similar to the native functions. Another&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/crackme0x09-dissected-with-radare2\/\">Continue reading<span class=\"screen-reader-text\">Crackme0x09 Dissected with Radare2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,1],"tags":[],"class_list":["post-38","post","type-post","status-publish","format-standard","hentry","category-radare2","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/38","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=38"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/38\/revisions"}],"predecessor-version":[{"id":126,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/38\/revisions\/126"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=38"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=38"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=38"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}