3

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be downloaded from radare's github site (I can't add the link as I do not have the reputation points). I think I can provide enough information to ask a properly formatted question.

I'm currently working on crackme0x09 and have run across a hurdle. I disassemble the main: disassembled main

I notice that the first call to sym.imp.printf is taking it's input from the ebx register which is referenced by an offset [ebx - 0x178b].

The ebx register is set, first, in fcn.08048766 which I disassemble: disassembled fcn.08048766

So, in order: 1) 0x84 is subtracted from the esp 2) ebx is set equal to the location esp contains in fcn.08048766 with: mov ebx, dword[esp] 3) 0x18f7 is added to the new value of the ebx 4) eax is loaded with this new address minus and offset lea eax, [ebx - 0x178b] 5) This is then pushed onto the stack for sym.imp.printf to print

If I print all the strings in the data section of the program (using iz command) I can see them there, but I'm having a hard time understanding how to interpret the results:

vaddr=0x08048838 paddr=0x00000838 ordinal=000 sz=5 len=4 section=.rodata type=ascii string=LOLO
vaddr=0x0804883d paddr=0x0000083d ordinal=001 sz=21 len=20 section=.rodata type=ascii string=Password Incorrect!\n
vaddr=0x08048855 paddr=0x00000855 ordinal=002 sz=14 len=13 section=.rodata type=ascii string=Password OK!\n
vaddr=0x08048863 paddr=0x00000863 ordinal=003 sz=6 len=5 section=.rodata type=ascii string=wtf?\n
vaddr=0x08048869 paddr=0x00000869 ordinal=004 sz=25 len=24 section=.rodata type=ascii string=IOLI Crackme Level 0x09\n
vaddr=0x08048882 paddr=0x00000882 ordinal=005 sz=11 len=10 section=.rodata type=ascii string=Password:

My question: How can I tell what string is referenced by [ebx - 0x178b] and subsequent ebx offsets?

Thanks.

6
  • This is a crackme from the IOLI series. They can be downloaded from radare's Github repo radare2-regressions. One of the users of this site, jvoisin, has written up how to solve all of them except crackme0x09, the one in the question, using r2.
    – julian
    Feb 23, 2017 at 0:14
  • Yes, thanks. I know the solution, but I'd like to figure out how to read these strings as they appear in the assembly. Feb 23, 2017 at 0:22
  • Would the solution be to check the GOT (I read this)? Rather than referring to the absolute memory address, it refers to the GOT, who's address is know, as an offset. But then how do I know where the GOT is in memory? Feb 23, 2017 at 0:52
  • I do not know how to use r2, but if you are able to dynamically analyze the program then all you have to do to read the strings being printed is look at the memory addresses in either eax or esp when a call to printf is made. These addresses are of strings in the .rodata section, not the GOT.
    – julian
    Feb 23, 2017 at 1:56
  • 1
    The file is stripped. The only symbols in the binary will be those corresponding to functions called from dynamically linked libraries. These symbols will be in the .dynsym section. This is why calls to printf and scanf are labelled but other function calls are not.
    – julian
    Feb 23, 2017 at 2:10

1 Answer 1

2

You are looking at so-called position-independent code (PIC). The program uses a helper function to get its current execution address into ebx and then adds a delta to it to calculate the address of the GOT (this works because even after the file has been moved in memory, the data segment including the GOT is still at the same offset from the function). To calculate ebx, you just need to remember that the call instruction pushes the return address onto the stack, so inside fcn.08048766 [esp] will contain 0x80486fd. Adding 0x18f7, we get 0x8049FF4 which should be the GOT address, and then you can subtract 0x178b to get 0x8048869 which should be the string.

1
  • I was confusing the address inside esp when inside fcn.08048766 with the current execution address when call is..called. So I thought it would be 0x80486f2 - 0x84 going into fcn.08048766. Thank you for the clarification. Feb 23, 2017 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.