I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be downloaded from radare's github site (I can't add the link as I do not have the reputation points). I think I can provide enough information to ask a properly formatted question.
I'm currently working on crackme0x09 and have run across a hurdle. I disassemble the main:
I notice that the first call to sym.imp.printf
is taking it's input from the ebx
register which is referenced by an offset [ebx - 0x178b]
.
The ebx
register is set, first, in fcn.08048766
which I disassemble:
So, in order:
1) 0x84
is subtracted from the esp
2) ebx
is set equal to the location esp
contains in fcn.08048766
with:
mov ebx, dword[esp]
3) 0x18f7
is added to the new value of the ebx
4) eax
is loaded with this new address minus and offset lea eax, [ebx - 0x178b]
5) This is then pushed onto the stack for sym.imp.printf
to print
If I print all the strings in the data section of the program (using iz
command) I can see them there, but I'm having a hard time understanding how to interpret the results:
vaddr=0x08048838 paddr=0x00000838 ordinal=000 sz=5 len=4 section=.rodata type=ascii string=LOLO
vaddr=0x0804883d paddr=0x0000083d ordinal=001 sz=21 len=20 section=.rodata type=ascii string=Password Incorrect!\n
vaddr=0x08048855 paddr=0x00000855 ordinal=002 sz=14 len=13 section=.rodata type=ascii string=Password OK!\n
vaddr=0x08048863 paddr=0x00000863 ordinal=003 sz=6 len=5 section=.rodata type=ascii string=wtf?\n
vaddr=0x08048869 paddr=0x00000869 ordinal=004 sz=25 len=24 section=.rodata type=ascii string=IOLI Crackme Level 0x09\n
vaddr=0x08048882 paddr=0x00000882 ordinal=005 sz=11 len=10 section=.rodata type=ascii string=Password:
My question: How can I tell what string is referenced by [ebx - 0x178b]
and subsequent ebx
offsets?
Thanks.
eax
oresp
when a call toprintf
is made. These addresses are of strings in the.rodata
section, not the GOT..dynsym
section. This is why calls toprintf
andscanf
are labelled but other function calls are not.