1

I am a newbie in reverse engineering and I was trying to understand this blog post:

http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html

At one point, the author says the following when looking at the arguments of a function he wants to run using symbolic execution:

Let's zoom into and find out more about the function sub_401084. It takes three arguments, namely (1) address to a buffer of bytes at 0x4010E4, which is presumbly the reference key for verification, (2) address to a user input buffer at 0x402159, and (3) the length of the user password supplied to the program.

My question is, how does he figure out the addresses of the 3 arguments? In IDA pro you just have the stack view with the offsets with respect to EBP. I have tried to do this calculation but I don't get his values. Can anyone tell me how I should reason? Thank you!

0

He probably didn't : the executable is packed, ASLR is disabled and relocations are stripped. Which means the two address arguments 0x4010E4 and 0x402159 are fixed.

enter image description here

There are major consequences since :

  • the first argument 0x4010E4 is sub_401000 ( sub_401084 caller) return address ! Since ASLR is disabled, this is a constant. You can see here :

enter image description here

  • the second argument 0x402159 is a static buffer in the binary .data segment. Since relocations are stripped, this is also a constant.

In the general case (ASLR + reloc), it's much more complicated. There is a great SO/RE question about extractin functions args in Idapython which then must be glued with angr Memory states in order to work properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.