0

Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for automating the following:

  1. Load executable
  2. Put breakpoint at a known address
  3. Provide a password as input for the executable
  4. When reaching the breakpoint set eax to 1
  5. Save any output of the executable
  • 1
    There are too many variables for an automated process. In the past I've extracted the asm I'm interested in and added it inline to a c/c++ app. Another method would be to load the binary from c/c++ and call the functions directly, much like you would do with a dll. – Twifty Sep 18 '18 at 18:07
  • 1
    This question is equivalent to "do you know any scriptable debugger"... – user202729 Sep 19 '18 at 15:55
  • Yes, it may be equivalent to "do you know any scriptable debugger"... – robert Sep 19 '18 at 16:21
  • If you will automate stuff on linux, note that ptrace will read/write data as 64 bit on 64 bit systems, not 32 bit. that means you should be carful with a code you reuse that was originally written to 32 bit, it might need modifications – Amirag Sep 22 '18 at 23:52
1

windbg in windows and gdb in linux both are capable of executing scripts to automate tasks

what you ask should be doable fairly easily in both of the debuggers

here is a demeo for windbg

source for a simple crackme that takes a password

:\>cat simcram.cpp
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int checkpass(char *pass) {
    return strcmp("goodboy" , pass);
}
int main(int argc , char *argv[] ) {
    if(argc != 2 ) {
        printf("usage %s password\n" , argv[0]);
        exit(0);
    }
    int res = checkpass(argv[1]);
    if(res == 0 ) {
        printf("please proceeed to vault\n");
    } else {
        printf("access denied incorrect password\n");
    }
    return res;
}

executing directly on console

:\>simcram.exe
usage simcram.exe password

:\>simcram.exe foobar
access denied incorrect password

:\>simcram.exe goodboy
please proceeed to vault

a scripted execution that would set eax to 0 irresepective on any password

:\>cdb -c "g simcram!checkpass;gu;r eax= 0;g;q" simcram.exe abracadabragiligilichoo

Microsoft (R) Windows Debugger Version 10.0.16299.15 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: simcram.exe abracadabragiligilichoo


ntdll!LdrpDoDebuggerBreak+0x2c:
77b205a6 cc              int     3
0:000> cdb: Reading initial command 'g simcram!checkpass;gu;r eax= 0;g;q'

please proceeed to vault  <<<<<<<<<<<<<<<<<
quit:
1

If the number of instructions executed is proportional to the number of characters correct (i.e, maybe it's a simple byte-by-byte strcmp), then you could use instrumentation tools like Pintool to count the number of instructions executed, and use that to brute-force the password byte-by-byte. Here's an example of that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.