0

Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing

I am able to figure out some of the assembly, but can't get the correct password. I know that it is two integers separated by a space.

EDIT: By using the command ps @ str.d__d you get the result of %d %d. It is located at the address 0x0804853f.

EDIT2: I figured out that there are multiple local variables being used:

var int local_2ch @ ebp-0x2c 
var int local_20h @ ebp-0x20 
var int local_1ch @ ebp-0x1c 
var unsigned int local_18h @ ebp-0x18 
var int local_14h @ ebp-0x14 
var int local_10h @ ebp-0x10
var int canary @ ebp-0xc
var int local_4h @ ebp-0x4 
arg int arg_4h @ esp+0x4 
  • how do you know that it's "two integers separated by a space"? what else did you figure out? – Igor Skochinsky Sep 24 '18 at 20:33
  • By using the command ps @ str.d__d you get the result of %d %d. This is all located at the address 0x0804853f. – rockower Sep 24 '18 at 20:47
  • 3
    please add what you already discovered to the question (click 'edit') – Igor Skochinsky Sep 24 '18 at 20:48
3

Here's how you can do it. Usual stuff : r2 file; aaa; pdf@sym.main

You can see the params to scanf pushed to stack.

|           0x08048537      8d45e4         lea eax, [local_1ch]
|           0x0804853a      50             push eax
|           0x0804853b      8d45e0         lea eax, [local_20h]
|           0x0804853e      50             push eax
|           0x0804853f      6855860408     push str.d__d               ; 0x8048655 ; "%d %d" ; const char *format
|           0x08048544      e887feffff     call sym.imp.__isoc99_scanf ; int scanf(const char *format)

Lets rename locals.

[0x080484eb]> afv?
Usage: afv  [rbs]
| afvr[?]                       manipulate register based arguments
| afvb[?]                       manipulate bp based arguments/locals
| afvs[?]                       manipulate sp based arguments/locals
| afv*                          output r2 command to add args/locals to flagspace
| afvR [varname]                list addresses where vars are accessed (READ)
| afvW [varname]                list addresses where vars are accessed (WRITE)
| afva                          analyze function arguments/locals
| afvd name                     output r2 command for displaying the value of args/locals in the debugger
| afvn [new_name] ([old_name])  rename argument/local
| afvt [name] [new_type]        change type for given argument/local
| afv-([name])                  remove all or given var

[0x080484eb]> afvn input_1 local_20h
[0x080484eb]> afvn input_2 local_1ch
[0x080484eb]> pdf@sym.main

Now it looks like

|           0x08048537      8d45e4         lea eax, [input_2]
|           0x0804853a      50             push eax
|           0x0804853b      8d45e0         lea eax, [input_1]
|           0x0804853e      50             push eax
|           0x0804853f      6855860408     push str.d__d               ; 0x8048655 ; "%d %d" ; const char *format
|           0x08048544      e887feffff     call sym.imp.__isoc99_scanf ; int scanf(const char *format)

There's a check for Correct/Incorrect

|       `-> 0x08048579      837de800       cmp dword [local_18h], 0
|       ,=< 0x0804857d      7412           je 0x8048591
|       |   0x0804857f      83ec0c         sub esp, 0xc
|       |   0x08048582      685b860408     push str.Correct            ; 0x804865b ; "Correct!" ; const char *s
|       |   0x08048587      e824feffff     call sym.imp.puts           ; int puts(const char *s)
|       |   0x0804858c      83c410         add esp, 0x10
|      ,==< 0x0804858f      eb10           jmp 0x80485a1
|      ||   ; CODE XREF from main (0x804857d)
|      |`-> 0x08048591      83ec0c         sub esp, 0xc
|      |    0x08048594      6864860408     push str.Incorrect          ; 0x8048664 ; "Incorrect!" ; const char *s
|      |    0x08048599      e812feffff     call sym.imp.puts           ; int puts(const char *s)
|      |    0x0804859e      83c410         add esp, 0x10

If local_18h is 1/0, Correct/Incorrect is printed out to stdout respectively. Rename local_18h to final_flag as it decides the final output.

[0x0804852b]> afvn final_flag local_18h

Some constants are loaded to local variables. Remember/rename them to follow in code.

|           0x0804850f      c745e8010000.  mov dword [final_flag], 1
|           0x08048516      c745ec2a0000.  mov dword [local_14h], 0x2a ; '*' ; 42
|           0x0804851d      c745f0390500.  mov dword [local_10h], 0x539 ; 1337

final_flag is initially 1 (true). Just after input, there's a check to set final_flag to 0(false).

|           0x0804854c      8b45ec         mov eax, dword [const_2a]
|           0x0804854f      35280a0000     xor eax, 0xa28
|           0x08048554      89c2           mov edx, eax
|           0x08048556      8b45e0         mov eax, dword [input_1]
|           0x08048559      39c2           cmp edx, eax
|       ,=< 0x0804855b      7407           je 0x8048564
|       |   0x0804855d      c745e8000000.  mov dword [final_flag], 0
|       |   ; CODE XREF from main (0x804855b)

This can be roughly translated to:

if const_2a^0xa28 != input_1:
    final_flag = False

To pass this input_1 = const_2a^0xa28

>>> 0x2a^0xa28
2562

Similar check for input_2

|       `-> 0x08048564      8b45f0         mov eax, dword [const_539]
|           0x08048567      f7d0           not eax
|           0x08048569      89c2           mov edx, eax
|           0x0804856b      8b45e4         mov eax, dword [input_2]
|           0x0804856e      39c2           cmp edx, eax
|       ,=< 0x08048570      7407           je 0x8048579
|       |   0x08048572      c745e8000000.  mov dword [final_flag], 0

This can be roughly translated to:

if ~const_539 != input_2:
    final_flag = False

To pass this input_2 = ~const_539

>>> ~0x539
-1338

Finally

./part2
Enter the password: 2562 -1338
Correct!

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.