1

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password.

The problem is I use a part of code into the main function to search the opcodes from .text section which could make the corresponding ASCII password.

So, using that part of code I get the offsets but when I remove that code the offsets change and I am left with garbage text.

If I change some code, can it be certain that after compilation the opcodes above it in PE file won't change ?

e.g. :

#include <windows.h>
#include <tchar.h>
#include <vector>
#include <iostream>
#include <iomanip>
#include <string>

#ifdef UNICODE
#  define tcout wcout
#  define tcerr wcerr
#else
#  define tcout cout
#  define tcerr cerr
#endif

const UINT DUMP_SIZE = 96;
const UINT DEFAULT_DUMP_SIZE = 4096;

using namespace std;

VOID ImageInformation( HMODULE& hModule, PVOID& pVirtualAddress,PVOID& pCodeStart, SIZE_T& dwCodeSize,PVOID& pCodeEnd );
int hsearch( LPCVOID pcbStartAddress, LPCVOID pDisplayBaseAddress,DWORD dwSize, int toSearch );
vector<int> calculate_flag(int []);// For checking the user input

int main(int argc, _TCHAR* argv[])
{
    cout<<"\t\t << Welcome to My CrackME >>\n\n"<<endl;
    cout<<"Enter 10 Numbers, I give you the flag "<<endl;
    HMODULE hModule = NULL;
    PVOID   pVirtualAddress = NULL;
    PVOID   pCodeStart = NULL;
    PVOID   pCodeEnd = NULL;
    SIZE_T  dwCodeSize = 0;

    ImageInformation( hModule, pVirtualAddress, pCodeStart,dwCodeSize, pCodeEnd );
    int input[10];
    for(int i=0; i<10; i++){
        cin>>input[i];
    }
    vector<int> result = calculate_flag(input);
    for(int i=0; i<40; i++){
        printf("%c",(((PBYTE)pCodeStart)[ input[i] ]));
    }
    //cout<<result<<endl;
    //
    cout<<endl;
    /*int flg[40] = {....flag array here...};
    vector <int> v;
    for(int characters=0; characters<40; characters++){
            int location = hsearch(pCodeStart, pCodeStart, dwCodeSize, flg[characters]);
            v.push_back(location);
            printf("%d ",location);
    }
    string res;
    for(int i=0; i<v.size(); i++){
        if(v[i] == -1){
            printf(" \n");
        }else{
            printf("%c",(((PBYTE)pCodeStart)[ v[i] ]));
            res.push_back((char)(((PBYTE)pCodeStart)[ v[i] ]));
        }
    }
    for(int i=0;i<100;i++)
        printf(" ");
    printf("%s\n",result);
    cout<<result<<endl;*/
    return 0;
}

vector<int> calculate_flag(int input[]){
....
Other functions defined
hsearch : Used to get the offsets

Problem

If I'm removing the hsearch function, why the offset of previous statements change ?

How do I get the part of code whose offset won't change, so as I can use that to make this crackme ?

  • @usr2564301 sorry, I don't get your point.What do you mean to say and how do I achieve what I want to achieve in this crackme ? – jame Mar 16 '18 at 19:17
  • @usr2564301 please don't use comments for answers. better make a proper answer and explain the reason. – Igor Skochinsky Mar 17 '18 at 20:13
  • @IgorSkochinsky: I can't tell OP how to properly do it. (OP also did not understand my comment, so nothing lost there.) – usr2564301 Mar 17 '18 at 21:01
  • @usr2564301 it could still be helpful for others having a similar issue... comments should be used to ask for clarifications, not answers (or attempts of) – Igor Skochinsky Mar 17 '18 at 21:04
1

Your question is very unclear, but as for this specific question:

If I change some code, can it be certain that after compilation the opcodes above it in PE file won't change ?

The answer is no. If you change part of the program, the compiler may change different parts of the program that you did not modify. The two most accessible examples are functions called by the function you modified, and functions that call the modified function. In both cases, your changes to one function might result in the compiler manufacturing a different calling convention for any of the functions just mentioned, or the compiler may perform something along the lines of interprocedural common subexpression elimination. Then there are other optimizations like profile-guided ones that might drastically change the binary, although you'll know if you're using profile-guided optimizations, which it seems very strongly like you aren't.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.