Avatao R3v3rs3 2

Question

I found this platform and its course path into Reverse Engineering.

Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure it out how the code can count the length of user's password. I can see in the disassembled code that:

Just before strlen call, EAX will point always to command line:

r2 -Ad ./reverse2.dms AAAAAAAAAAAAAAAAAAAAAAAAAAA

It will count always 0x0e chars because of the length of string ./reverse2.dms and not the length of the submitted password.

I don't know if is it a bug or ... maybe ... I simply don't get it. But as for this situation, interesting loop is never reached because 0x0e < 0x15.

I can rename the binary and jump over the first block but... honestly I'm afraid it's not the right way.

Am I wrong?

Answer 1

As your initial instincts told you, it is quite a simple challenge and you are close. Let's understand together the logic of the program. As you did, I used radare2.

Let's open the program in radare2:

$ r2 reverse2

Analyze the binary and print the main function:

[0x08048350]> aa
[0x08048350]> pdf @ main

If you want to, you can use radare's great Visual Graph Mode to easily detect the function's flow:

[0x08048350]> VV @ main

First the program checks whether you pass at least one argument to the program, i.e num_of_arguments > 1. Remember that the filename counts as 1 argument so you'll need another one.

0x08048456      837d0801       cmp dword [arg_8h], 1
0x0804845a      7f16           jg 0x804847

Then it checks if the file name is more than 15 characters long:

0x08048472      8b450c         mov eax, dword [arg_ch]     ; [0xc:4]=-1 ; 12
0x08048475      8b00           mov eax, dword [eax]
0x08048477      89442418       mov dword [local_18h], eax
0x0804847b      8b442418       mov eax, dword [local_18h]  ; [0x18:4]=-1 ; 24
0x0804847f      890424         mov dword [esp], eax
0x08048482      e8a9feffff     call sym.imp.strlen         ; size_t strlen(const char *s)
0x08048487      8944241c       mov dword [local_1ch], eax
0x0804848b      837c241c15     cmp dword [local_1ch], 0x15 ; [0x15:4]=-1 ; 21

So, you need to change the file name to be more than 15 characters long and pass it at least one argument.

Now for the interesting part. In the following conditions, the program is checking whether filename[some_offset] == chr(0x??) and if yes, it goes to another offset in the file name and checks the value there.
So, for example, in the first check you can see:

0x080484a7      8b442418       mov eax, dword [local_18h]
0x080484ab      83c014         add eax, 0x14
0x080484ae      0fb600         movzx eax, byte [eax]
0x080484b1      3c73           cmp al, 0x73                ; 's' ; 115

In this block it checks whether filename[0x14] == chr(0x73) which radare hints you that 0x73 equals the letter 's'.

If yes, it jumps to another block:

0x080484b9      8b442418       mov eax, dword [local_18h]
0x080484bd      83c008         add eax, 8
0x080484c0      0fb600         movzx eax, byte [eax]
0x080484c3      3c67           cmp al, 0x67                ; 'g' ; 103

In this block the program checks whether filename[8]=='g'.
And so on until it checks all the offsets.

I'll leave it to you to solve it and figure out what should be the name of the program.
Good luck!

Answer 2

Well it looks like this is exactly what you should do as the code check for the name of the binary and not the parameters passed to it, as argv[0] is the "file name of the binary".

So you solution is to either change the name to be longer than 0x15 or to patch the binary. Maybe later there will be something that will steer to one of those solutions (i.e. checking the name) but for now it's looks like you can pick any.