1

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all of the dissassembly here if it would help.

I'm working on number 5 and I'm confused on one aspect. I understand how to get the solution and get the password ok, but there seems to be a length on the input that I can't trace back to any of the assembly.

The numbers can add up to more than the 10h and the last one can be odd, but once the input is passed 9 characters, it's not accepted.

enter image description here

I'm using gdb and ida and whatever other tools seem helpful, but the specific tools don't matter much to me. Post an explanation with a radare output if you want.

3

The reason for your observation is an overflow in the sscanf call that is done in the function checking if the number is even or odd. While the check for your 9-character password succeeds the 10-character password produces an overflow and the check fails.

To verify, compile and run the following C code:

#include <stdio.h>
#include <stdlib.h>


int main ( ) 
{
    int number;

    sscanf ( "222222222", "%d", &number );
    printf ( "Number (9 digits): %d\n", number ); 

    sscanf ( "2222222222", "%d", &number );
    printf ( "Number (10 digits): %d\n", number );

    if ( number & 0x01 == 0 ) {
        printf ( "Even!\n" );
    }
    else {
        printf ( "Odd!\n" );
    }
    return 0;
}
  • Oh, gotcha. Because it's reading as a signed decimal, the max you get for a 32 bit value isn't enough to store 10 2's. It's not the length of the input but the magnitude overflowing the integer range. Thanks. – Praet May 11 '17 at 15:46
  • Yes, exactly. If you like my answer, you are free to accept it :-) – bns May 12 '17 at 12:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.