-2

This binary was from a CTF challenge.

I found 2 way to solve this, one is run & debug the bin, set a break point and see result in flag after the bin running, another is trying to understand the function.

There are some parts that i dont understand even when i solved this challenge :

Why my IDA reverse the string (v6 should be "Bkav" and v7 + v8 should be "Security"

As you see, it pass the char* v6 ("Bkav") into the func01 and func02, but when i do the same thing, it give wrong flag. But when i try to pass the "BkavSecurity" in to func01 and func02, it give me right flag. Quite confuse about this.

enter image description here

You can find file here : https://www.sendspace.com/file/g7w8nz

closed as unclear what you're asking by 0xC0000022L, perror, TechLord, kn0x, 0xec May 18 '18 at 6:43

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    please give this question a more meaningful title – Paweł Łukasik May 13 '18 at 12:56
  • You're passing a flag? Where? It's not clear to me what you're asking here. – 0xC0000022L May 14 '18 at 8:29
0

Remember that what you're passing is an address. And the address of v6 and since v6,v7 and v8 are adjacent to each other so any method that works on char * will read from one to the other until it reaches byte 0.

Letter |  Address | Variable
   B   | ebp-7e5h | -> v6 (4 bytes)
   k   | ebp-7e4h | 
   a   | ebp-7e3h | 
   v   | ebp-7e2h | 
   S   | ebp-7e1h | -> v7 (4 bytes)
   e   | ebp-7e0h |
   c   | ebp-7dfh |
   u   | ebp-7deh |
   r   | ebp-7ddh | -> v8 (4 bytes)
   i   | ebp-7dch |
   t   | ebp-7dbh |
   y   | ebp-7dah |
  \0   | ebp-7d9h | -> v9 (1 byte)
1

well you can create a stackvar K on all the four instructions and convert those stack variables to an array of proper length

then you can see ida showing you the offsets from base the screen shot is from ida free 5 on a 32 bit machine (it doesn't decompile )

but in your case i think decompilation would be more better ( this construct is an inlined/unrolled strcpy(src,dest)

enter image description here

Not the answer you're looking for? Browse other questions tagged or ask your own question.