Finding hidden string location using radare2 on ELF binaries

Question

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be downloaded from radare's github site (I can't add the link as I do not have the reputation points). I think I can provide enough information to ask a properly formatted question.

I'm currently working on crackme0x09 and have run across a hurdle. I disassemble the main:

I notice that the first call to sym.imp.printf is taking it's input from the ebx register which is referenced by an offset [ebx - 0x178b].

The ebx register is set, first, in fcn.08048766 which I disassemble:

So, in order: 1) 0x84 is subtracted from the esp 2) ebx is set equal to the location esp contains in fcn.08048766 with: mov ebx, dword[esp] 3) 0x18f7 is added to the new value of the ebx 4) eax is loaded with this new address minus and offset lea eax, [ebx - 0x178b] 5) This is then pushed onto the stack for sym.imp.printf to print

If I print all the strings in the data section of the program (using iz command) I can see them there, but I'm having a hard time understanding how to interpret the results:

vaddr=0x08048838 paddr=0x00000838 ordinal=000 sz=5 len=4 section=.rodata type=ascii string=LOLO
vaddr=0x0804883d paddr=0x0000083d ordinal=001 sz=21 len=20 section=.rodata type=ascii string=Password Incorrect!\n
vaddr=0x08048855 paddr=0x00000855 ordinal=002 sz=14 len=13 section=.rodata type=ascii string=Password OK!\n
vaddr=0x08048863 paddr=0x00000863 ordinal=003 sz=6 len=5 section=.rodata type=ascii string=wtf?\n
vaddr=0x08048869 paddr=0x00000869 ordinal=004 sz=25 len=24 section=.rodata type=ascii string=IOLI Crackme Level 0x09\n
vaddr=0x08048882 paddr=0x00000882 ordinal=005 sz=11 len=10 section=.rodata type=ascii string=Password:

My question: How can I tell what string is referenced by [ebx - 0x178b] and subsequent ebx offsets?

Thanks.

Answer 1

You are looking at so-called position-independent code (PIC). The program uses a helper function to get its current execution address into ebx and then adds a delta to it to calculate the address of the GOT (this works because even after the file has been moved in memory, the data segment including the GOT is still at the same offset from the function). To calculate ebx, you just need to remember that the call instruction pushes the return address onto the stack, so inside fcn.08048766 [esp] will contain 0x80486fd. Adding 0x18f7, we get 0x8049FF4 which should be the GOT address, and then you can subtract 0x178b to get 0x8048869 which should be the string.