I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that:
(gdb) info files
...
Entry point: 0xcf8
...
So I set a breakpoint at the entry point
and run the program:
(gdb) break *0xcf8
Breakpoint 1 at 0xcf8
(gdb) run
Starting program: /home/tathanhdinh/CTFs/hackercalc
Error in re-setting breakpoint 1: Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8
Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8
That seems this breakpoint does not work. I do not understand why it says Cannot access memory at address 0xcf8
but I guess that there was some code which runs before has made some interference (so the program cannot reach this entry point), as far as I know, this code must be the elf interpreter
of the program.
So, I look into segments of the program to check this interpreter, all seems to be normal (except that readelf
says the program is a shared object file
, but I think that is not important):
readelf --segments hackercalc
Elf file type is DYN (Shared object file)
Entry point 0xcf8
There are 8 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x00000034 0x00000034 0x00100 0x00100 R E 0x4
INTERP 0x000154 0x00000154 0x00000154 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x00000000 0x00000000 0x16b4a 0x16b4a R E 0x1000
LOAD 0x016eac 0x00017eac 0x00017eac 0x001e4 0x001ec RW 0x1000
Now, I try to get again information about this process:
(gdb) info files
Symbols from "/home/tathanhdinh/CTFs/hackercalc".
Native process:
Using the running image of child process 10545.
While running this, GDB does not access memory from...
Local exec file:
`/home/tathanhdinh/CTFs/hackercalc', file type elf32-i386.
Entry point: 0x56555cf8
And I am totally lost here, why the elf interpreter
(which is ld-linux.so.2
) can create a new process in this case?
I try another approach by loading the challenge into IDA, set a breakpoint at the entry point, then run but IDA simply hangs up!!!
So my question is: how can this happen? Am I totally wrong about the code executed before the entry point? Does the challenge use some special tricks to bypass debugging?
NB1. Thanks to @Igor, I finally find out how to debug this challenge. In summary, I disable ALSR to get a stable address of the entry point. Then I load it into gdbserver, use IDA to attach this debug session, set a breakpoint at the entry point (whose address is stable by disabling ALSR).