I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be downloaded from radare's github site (I can't add the link as I do not have the reputation points). I think I can provide enough information to ask a properly formatted question.

I'm currently working on crackme0x09 and have run across a hurdle. I disassemble the main: disassembled main

I notice that the first call to sym.imp.printf is taking it's input from the ebx register which is referenced by an offset [ebx - 0x178b].

The ebx register is set, first, in fcn.08048766 which I disassemble: disassembled fcn.08048766

So, in order: 1) 0x84 is subtracted from the esp 2) ebx is set equal to the location esp contains in fcn.08048766 with: mov ebx, dword[esp] 3) 0x18f7 is added to the new value of the ebx 4) eax is loaded with this new address minus and offset lea eax, [ebx - 0x178b] 5) This is then pushed onto the stack for sym.imp.printf to print

If I print all the strings in the data section of the program (using iz command) I can see them there, but I'm having a hard time understanding how to interpret the results:

vaddr=0x08048838 paddr=0x00000838 ordinal=000 sz=5 len=4 section=.rodata type=ascii string=LOLO
vaddr=0x0804883d paddr=0x0000083d ordinal=001 sz=21 len=20 section=.rodata type=ascii string=Password Incorrect!\n
vaddr=0x08048855 paddr=0x00000855 ordinal=002 sz=14 len=13 section=.rodata type=ascii string=Password OK!\n
vaddr=0x08048863 paddr=0x00000863 ordinal=003 sz=6 len=5 section=.rodata type=ascii string=wtf?\n
vaddr=0x08048869 paddr=0x00000869 ordinal=004 sz=25 len=24 section=.rodata type=ascii string=IOLI Crackme Level 0x09\n
vaddr=0x08048882 paddr=0x00000882 ordinal=005 sz=11 len=10 section=.rodata type=ascii string=Password:

My question: How can I tell what string is referenced by [ebx - 0x178b] and subsequent ebx offsets?


  • This is a crackme from the IOLI series. They can be downloaded from radare's Github repo radare2-regressions. One of the users of this site, jvoisin, has written up how to solve all of them except crackme0x09, the one in the question, using r2. – julian Feb 23 '17 at 0:14
  • Yes, thanks. I know the solution, but I'd like to figure out how to read these strings as they appear in the assembly. – corporateWhore Feb 23 '17 at 0:22
  • Would the solution be to check the GOT (I read this)? Rather than referring to the absolute memory address, it refers to the GOT, who's address is know, as an offset. But then how do I know where the GOT is in memory? – corporateWhore Feb 23 '17 at 0:52
  • I do not know how to use r2, but if you are able to dynamically analyze the program then all you have to do to read the strings being printed is look at the memory addresses in either eax or esp when a call to printf is made. These addresses are of strings in the .rodata section, not the GOT. – julian Feb 23 '17 at 1:56
  • I've never used gdb on a program I didn't personally compile, where would it get the symbols? I'll google around and try to figure it out. Thanks – corporateWhore Feb 23 '17 at 2:03

You are looking at so-called position-independent code (PIC). The program uses a helper function to get its current execution address into ebx and then adds a delta to it to calculate the address of the GOT (this works because even after the file has been moved in memory, the data segment including the GOT is still at the same offset from the function). To calculate ebx, you just need to remember that the call instruction pushes the return address onto the stack, so inside fcn.08048766 [esp] will contain 0x80486fd. Adding 0x18f7, we get 0x8049FF4 which should be the GOT address, and then you can subtract 0x178b to get 0x8048869 which should be the string.

  • I was confusing the address inside esp when inside fcn.08048766 with the current execution address when call is..called. So I thought it would be 0x80486f2 - 0x84 going into fcn.08048766. Thank you for the clarification. – corporateWhore Feb 23 '17 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.