Debug point not hit with radare2

Question

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function :

radare2.exe ch15.exe
aaa
s main
pdf

This is the output of the pdf command :

[0x004017b8]> pdf
/ (fcn) main 80
|   main (int argc, char **argv, char **envp);
|           ; arg signed int arg_8h @ ebp+0x8
|           ; arg char **s @ ebp+0xc
|           ; var size_t local_4h @ esp+0x4
|           ; CALL XREF from section..text (+0x3f4)
|           0x004017b8      55             push ebp
|           0x004017b9      89e5           mov ebp, esp
|           0x004017bb      83e4f0         and esp, 0xfffffff0
|           0x004017be      83ec10         sub esp, 0x10
|           0x004017c1      e87a0d0000     call fcn.00402540
|           0x004017c6      837d0801       cmp dword [arg_8h], 1       ; [0x8:4]=-1 ; 1
|       ,=< 0x004017ca      7e28           jle 0x4017f4
|       |   0x004017cc      8b450c         mov eax, dword [s]          ; [0xc:4]=-1 ; 12
|       |   0x004017cf      83c004         add eax, 4
|       |   0x004017d2      8b00           mov eax, dword [eax]
|       |   0x004017d4      890424         mov dword [esp], eax        ; const char *s
|       |   0x004017d7      e894100000     call sub.msvcrt.dll_strlen_870 ; size_t strlen(const char *s)
|       |   0x004017dc      89c2           mov edx, eax
|       |   0x004017de      8b450c         mov eax, dword [s]          ; [0xc:4]=-1 ; 12
|       |   0x004017e1      83c004         add eax, 4
|       |   0x004017e4      8b00           mov eax, dword [eax]
|       |   0x004017e6      89542404       mov dword [local_4h], edx
|       |   0x004017ea      890424         mov dword [esp], eax
|       |   0x004017ed      e834ffffff     call sub.Gratz_man_:_726    ; sub.Usage:__s_pass_700+0x26
|      ,==< 0x004017f2      eb0d           jmp 0x401801
|      ||   ; CODE XREF from main (0x4017ca)
|      |`-> 0x004017f4      8b450c         mov eax, dword [s]          ; [0xc:4]=-1 ; 12
|      |    0x004017f7      8b00           mov eax, dword [eax]
|      |    0x004017f9      890424         mov dword [esp], eax
|      |    0x004017fc      e8fffeffff     call sub.Usage:__s_pass_700
|      |    ; CODE XREF from main (0x4017f2)
|      `--> 0x00401801      b800000000     mov eax, 0
|           0x00401806      c9             leave
\           0x00401807      c3             ret
[0x004017b8]>

I can see that a function is called named sub.Usage:__s_pass_700, probably the password. I go to this function with this command :

s sub.Usage:__s_pass_700
pdf

The output is :

[0x00401700]> pdf
/ (fcn) sub.Usage:__s_pass_700 184
|   sub.Usage:__s_pass_700 (int arg_8h, unsigned int arg_ch);
|           ; var int local_ch @ ebp-0xc
|           ; arg int arg_8h @ ebp+0x8
|           ; arg unsigned int arg_ch @ ebp+0xc
|           ; var int local_4h @ esp+0x4
|           ; CALL XREF from main (0x4017fc)
|           0x00401700      55             push ebp
|           0x00401701      89e5           mov ebp, esp
|           0x00401703      83ec18         sub esp, 0x18
|           0x00401706      b844404000     mov eax, str.Usage:__s_pass ; 0x404044 ; "Usage: %s pass"
|           0x0040170b      8b5508         mov edx, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|           0x0040170e      89542404       mov dword [local_4h], edx
|           0x00401712      890424         mov dword [esp], eax        ; const char *format
|           0x00401715      e896110000     call sub.msvcrt.dll_printf_8b0 ; int printf(const char *format)
|           0x0040171a      c70424000000.  mov dword [esp], 0
|           0x00401721      e87a110000     call sub.msvcrt.dll_exit_8a0
|           ;-- sub.Gratz_man_:_726:
|           ; CALL XREF from main (0x4017ed)
|           0x00401726      55             push ebp
|           0x00401727      89e5           mov ebp, esp
|           0x00401729      83ec28         sub esp, 0x28               ; '('
|           0x0040172c      c745f4000000.  mov dword [local_ch], 0
|           0x00401733      837d0c07       cmp dword [arg_ch], 7       ; [0xc:4]=-1 ; 7
|       ,=< 0x00401737      7571           jne 0x4017aa
|       |   0x00401739      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|       |   0x0040173c      0fb600         movzx eax, byte [eax]
|       |   0x0040173f      3c53           cmp al, 0x53                ; 'S' ; 83
|      ,==< 0x00401741      7567           jne 0x4017aa
|      ||   0x00401743      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|      ||   0x00401746      83c001         add eax, 1
|      ||   0x00401749      0fb600         movzx eax, byte [eax]
|      ||   0x0040174c      3c50           cmp al, 0x50                ; 'P' ; 80
|     ,===< 0x0040174e      755a           jne 0x4017aa
|     |||   0x00401750      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|     |||   0x00401753      83c002         add eax, 2
|     |||   0x00401756      0fb600         movzx eax, byte [eax]
|     |||   0x00401759      3c61           cmp al, 0x61                ; 'a' ; 97
|    ,====< 0x0040175b      754d           jne 0x4017aa
|    ||||   0x0040175d      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|    ||||   0x00401760      83c003         add eax, 3
|    ||||   0x00401763      0fb600         movzx eax, byte [eax]
|    ||||   0x00401766      3c43           cmp al, 0x43                ; 'C' ; 67
|   ,=====< 0x00401768      7540           jne 0x4017aa
|   |||||   0x0040176a      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|   |||||   0x0040176d      83c004         add eax, 4
|   |||||   0x00401770      0fb600         movzx eax, byte [eax]
|   |||||   0x00401773      3c49           cmp al, 0x49                ; 'I' ; 73
|  ,======< 0x00401775      7533           jne 0x4017aa
|  ||||||   0x00401777      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|  ||||||   0x0040177a      83c005         add eax, 5
|  ||||||   0x0040177d      0fb600         movzx eax, byte [eax]
|  ||||||   0x00401780      3c6f           cmp al, 0x6f                ; 'o' ; 111
| ,=======< 0x00401782      7526           jne 0x4017aa
| |||||||   0x00401784      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
| |||||||   0x00401787      83c006         add eax, 6
| |||||||   0x0040178a      0fb600         movzx eax, byte [eax]
| |||||||   0x0040178d      3c53           cmp al, 0x53                ; 'S' ; 83
| ========< 0x0040178f      7519           jne 0x4017aa
| |||||||   0x00401791      b853404000     mov eax, str.Gratz_man_:    ; 0x404053 ; "Gratz man :)"
| |||||||   0x00401796      890424         mov dword [esp], eax        ; const char *format
| |||||||   0x00401799      e812110000     call sub.msvcrt.dll_printf_8b0 ; int printf(const char *format)
| |||||||   0x0040179e      c70424000000.  mov dword [esp], 0
| |||||||   0x004017a5      e8f6100000     call sub.msvcrt.dll_exit_8a0
| |||||||   ; XREFS: CODE 0x00401737  CODE 0x00401741  CODE 0x0040174e  CODE 0x0040175b  CODE 0x00401768
| |||||||   ; XREFS: CODE 0x00401775  CODE 0x00401782  CODE 0x0040178f
| ```````-> 0x004017aa      c70424604040.  mov dword [esp], str.Wrong_password ; [0x404060:4]=0x6e6f7257 ; "Wrong password" ; const char *s
|           0x004017b1      e802110000     call sub.msvcrt.dll_puts_8b8 ; int puts(const char *s)
|           0x004017b6      c9             leave
\           0x004017b7      c3             ret
[0x00401700]>

Now I can see that the instruction | ========< 0x0040178f 7519 jne 0x4017aa compare the password with the parameter passed as argument. I would like now put a breakpoint on the jne instruction but I can't because the memory is unmapped. I execute the command to execute the program :

ood ABadPassword
db 0x0040178f
dc

The result is :

[0x771ece30]> dc
(5448) loading library at 77180000 (C:\Windows\SysWOW64\ntdll.dll) ntdll.dll
(5448) unloading library at 000C0000 (not cached) not cached
(5448) unloading library at 75580000 (not cached) not cached
(5448) unloading library at 00610000 (not cached) not cached
(5448) loading library at 75580000 (C:\Windows\SysWOW64\kernel32.dll) kernel32.dll
(5448) loading library at 73A60000 (C:\Windows\SysWOW64\KernelBase.dll) KernelBase.dll
(5448) loading library at 74060000 (C:\Windows\SysWOW64\msvcrt.dll) msvcrt.dll

I don't understand why I don't hit the break point. Also, I am obligated to execute twice the dc command to see : wrong password. My goal is to change the rip next addess.

Answer 1

Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself.

You wrote

Now I can see that the instruction | ========< 0x0040178f 7519 jne 0x4017aa compare the password with the parameter passed as argument.

This is wrong. It doesn't not compare 'the password', it compare one of the character of the password. If you check the code there are some other instructions that are being executed and already validated your password as wrong so the line at 0x40178f is not even reached with 'ABadPassword' passed as an argument.

You need to analyse code more carefully and see where earlier in the code the breakpoint should be put.

As for your second problem

Also, I am obligated to execute twice the dc command to see : wrong password.

There might be some debug event that radare2 responds to with the break of your code execution, thus require you to decide what to do. If it's not exceptional then dc should get execution further.