2

I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp instruction. According to this block of code :

|    ; DATA XREF from sym.main (0x804848e)
|    0x08048497      b88a55ea8b     mov eax, 0x8bea558a
|    0x0804849c      45             inc ebp
|    0x0804849d      f4             hlt
|    0x0804849e      83c004         add eax, 4
|    0x080484a1      8a00           mov al, byte [eax]
|    0x080484a3      38c2           cmp dl, al
|,=< 0x080484a5      753d           jne 0x80484e4

How can I print the eax value to understand what are compared in the instruction ?

0x080484a1 8a00 mov al, byte [eax]

According to this question, I tried the 0x080484a1 but when I enter the command pxr 1 @ eax+0x4, nothing appears. If I enter the command pxr @ eax+0x4, this code appears :

0x080c288c  0x6f6c6165  ealo ascii
0x080c2890  0x00796768  hgy. ascii

The ascii printed is linked with the string compared ksuiealohgy.

2
  • does the execution reach that place ? there is a hlt instruction before i dont think your execution will reach this point if the flow was linear en.wikipedia.org/wiki/HLT_(x86_instruction)
    – blabb
    Commented Mar 4, 2019 at 4:31
  • Yes it reach that place.The problem is solved, thanks for your contribution.
    – Anonymous
    Commented Mar 4, 2019 at 12:31

1 Answer 1

3

Not sure why you used pxr as you could get the output with px 1 @ eax+0x4. But another options would be that you could run this opcode and then read the register value of al to get that. But in order to do that you need to use debugger commands instead (of course you need to be in debugging mode):

[0x7f5953803e90]> dr?
Usage: dr   Registers commands
| dr                     Show 'gpr' registers
<snip>

So to get the value of al execute during debugging session:

[0x7f5953803e90]> dr al
0x00000090

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.