1

I just finished this challenge. This is the content of main function :

[0x08048a86]> pdf
/ (fcn) main 417
|   main (int argc, char **argv, char **envp);
|           ; var int local_16h @ ebp-0x16
|           ; var int local_15h @ ebp-0x15
|           ; var int local_14h @ ebp-0x14
|           ; var int local_10h @ ebp-0x10
|           ; var int local_ch @ ebp-0xc
|           ; var int local_8h_2 @ ebp-0x8
|           ; var char *local_4h @ esp+0x4
|           ; var int local_8h @ esp+0x8
|           ; DATA XREF from entry0 (0x80488a7)
|           0x08048a86      8d4c2404       lea ecx, [local_4h]         ; 4
|           0x08048a8a      83e4f0         and esp, 0xfffffff0
|           0x08048a8d      ff71fc         push dword [ecx - 4]
|           0x08048a90      55             push ebp
|           0x08048a91      89e5           mov ebp, esp
|           0x08048a93      53             push ebx
|           0x08048a94      51             push ecx
|           0x08048a95      83ec20         sub esp, 0x20
|           0x08048a98      89cb           mov ebx, ecx
|           0x08048a9a      833b01         cmp dword [ebx], 1
|       ,=< 0x08048a9d      7f4f           jg 0x8048aee
|       |   0x08048a9f      8b4304         mov eax, dword [ebx + 4]    ; [0x4:4]=-1 ; 4
|       |   0x08048aa2      8b18           mov ebx, dword [eax]
|       |   0x08048aa4      c7442404b18d.  mov dword [local_4h], str.usage_: ; [0x8048db1:4]=0x67617375 ; "usage : "
|       |   0x08048aac      c7042460b004.  mov dword [esp], obj._ZSt4cerr__GLIBCXX_3.4 ; [0x804b060:4]=0
|       |   0x08048ab3      e838fdffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|       |   0x08048ab8      895c2404       mov dword [local_4h], ebx
|       |   0x08048abc      890424         mov dword [esp], eax
|       |   0x08048abf      e82cfdffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|       |   0x08048ac4      c7442404ba8d.  mov dword [local_4h], str.password ; [0x8048dba:4]=0x73617020 ; " password"
|       |   0x08048acc      890424         mov dword [esp], eax
|       |   0x08048acf      e81cfdffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|       |   0x08048ad4      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff
|       |   0x08048adc      890424         mov dword [esp], eax
|       |   0x08048adf      e85cfdffff     call sym.std::ostream::operator___std::ostream_____std::ostream
|       |   0x08048ae4      bb05000000     mov ebx, 5
|      ,==< 0x08048ae9      e92b010000     jmp 0x8048c19
|      ||   ; CODE XREF from main (0x8048a9d)
|      |`-> 0x08048aee      8d45eb         lea eax, [local_15h]
|      |    0x08048af1      890424         mov dword [esp], eax
|      |    0x08048af4      e867fdffff     call sym.std::allocator_char_::allocator
|      |    0x08048af9      8d45eb         lea eax, [local_15h]
|      |    0x08048afc      89442408       mov dword [local_8h], eax
|      |    0x08048b00      c7442404c48d.  mov dword [local_4h], 0x8048dc4 ; [0x8048dc4:4]=0xca15d618
|      |    0x08048b08      8d45f4         lea eax, [local_ch]
|      |    0x08048b0b      890424         mov dword [esp], eax
|      |    0x08048b0e      e80dfdffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const
|      |    0x08048b13      8d45ea         lea eax, [local_16h]
|      |    0x08048b16      890424         mov dword [esp], eax
|      |    0x08048b19      e842fdffff     call sym.std::allocator_char_::allocator
|      |    0x08048b1e      8d45ea         lea eax, [local_16h]
|      |    0x08048b21      89442408       mov dword [local_8h], eax
|      |    0x08048b25      c7442404cc8d.  mov dword [local_4h], 0x8048dcc ; [0x8048dcc:4]=0xaf67b350
|      |    0x08048b2d      8d45f0         lea eax, [local_10h]
|      |    0x08048b30      890424         mov dword [esp], eax
|      |    0x08048b33      e8e8fcffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const
|      |    0x08048b38      8d45ec         lea eax, [local_14h]
|      |    0x08048b3b      8d55f4         lea edx, [local_ch]
|      |    0x08048b3e      89542408       mov dword [local_8h], edx
|      |    0x08048b42      8d55f0         lea edx, [local_10h]
|      |    0x08048b45      89542404       mov dword [local_4h], edx
|      |    0x08048b49      890424         mov dword [esp], eax
|      |    0x08048b4c      e83cfeffff     call sym.plouf_std::string_std::string
|      |    0x08048b51      83ec04         sub esp, 4
|      |    0x08048b54      8d45f0         lea eax, [local_10h]
|      |    0x08048b57      890424         mov dword [esp], eax
|      |    0x08048b5a      e8a1fcffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string
|      |    0x08048b5f      8d45ea         lea eax, [local_16h]
|      |    0x08048b62      890424         mov dword [esp], eax
|      |    0x08048b65      e8c6fcffff     call sym.std::allocator_char_::_allocator
|      |    0x08048b6a      8d45f4         lea eax, [local_ch]
|      |    0x08048b6d      890424         mov dword [esp], eax
|      |    0x08048b70      e88bfcffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string
|      |    0x08048b75      8d45eb         lea eax, [local_15h]
|      |    0x08048b78      890424         mov dword [esp], eax
|      |    0x08048b7b      e8b0fcffff     call sym.std::allocator_char_::_allocator
|      |    0x08048b80      8b4304         mov eax, dword [ebx + 4]    ; [0x4:4]=-1 ; 4
|      |    0x08048b83      83c004         add eax, 4
|      |    0x08048b86      8b00           mov eax, dword [eax]
|      |    0x08048b88      89442404       mov dword [local_4h], eax
|      |    0x08048b8c      8d45ec         lea eax, [local_14h]
|      |    0x08048b8f      890424         mov dword [esp], eax
|      |    0x08048b92      e860010000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst
|      |    0x08048b97      84c0           test al, al
|      |,=< 0x08048b99      744a           je 0x8048be5
|      ||   0x08048b9b      c7442404fc8d.  mov dword [local_4h], str.Bravo__tu_peux_valider_en_utilisant_ce_mot_de_passe... ; [0x8048dfc:4]=0x76617242 ; "Bravo, tu peux valider en utilisant ce mot de passe..."
|      ||   0x08048ba3      c7042400b104.  mov dword [esp], obj._ZSt4cout__GLIBCXX_3.4 ; [0x804b100:4]=0
|      ||   0x08048baa      e841fcffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|      ||   0x08048baf      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff
|      ||   0x08048bb7      890424         mov dword [esp], eax
|      ||   0x08048bba      e881fcffff     call sym.std::ostream::operator___std::ostream_____std::ostream
|      ||   0x08048bbf      c7442404348e.  mov dword [local_4h], str.Congratz._You_can_validate_with_this_password... ; [0x8048e34:4]=0x676e6f43 ; "Congratz. You can validate with this password..."
|      ||   0x08048bc7      c7042400b104.  mov dword [esp], obj._ZSt4cout__GLIBCXX_3.4 ; [0x804b100:4]=0
|      ||   0x08048bce      e81dfcffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|      ||   0x08048bd3      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff
|      ||   0x08048bdb      890424         mov dword [esp], eax
|      ||   0x08048bde      e85dfcffff     call sym.std::ostream::operator___std::ostream_____std::ostream
|     ,===< 0x08048be3      eb24           jmp 0x8048c09
|     |||   ; CODE XREF from main (0x8048b99)
|     ||`-> 0x08048be5      c7442404658e.  mov dword [local_4h], str.Password_incorrect. ; [0x8048e65:4]=0x73736150 ; "Password incorrect."
|     ||    0x08048bed      c7042400b104.  mov dword [esp], obj._ZSt4cout__GLIBCXX_3.4 ; [0x804b100:4]=0
|     ||    0x08048bf4      e8f7fbffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|     ||    0x08048bf9      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff
|     ||    0x08048c01      890424         mov dword [esp], eax
|     ||    0x08048c04      e837fcffff     call sym.std::ostream::operator___std::ostream_____std::ostream
|     ||    ; CODE XREF from main (0x8048be3)
|     `---> 0x08048c09      bb00000000     mov ebx, 0
|      |    0x08048c0e      8d45ec         lea eax, [local_14h]
|      |    0x08048c11      890424         mov dword [esp], eax
|      |    0x08048c14      e8e7fbffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string
|      |    ; CODE XREF from main (0x8048ae9)
|      `--> 0x08048c19      89d8           mov eax, ebx
|       ,=< 0x08048c1b      eb75           jmp 0x8048c92
..
|       |   ; CODE XREF from main (0x8048c1b)
|       `-> 0x08048c92      8d65f8         lea esp, [local_8h_2]
|           0x08048c95      59             pop ecx
|           0x08048c96      5b             pop ebx
|           0x08048c97      5d             pop ebp
|           0x08048c98      8d61fc         lea esp, [ecx - 4]
\           0x08048c9b      c3             ret

I solved it by placing a breakpoint to 0x08048b99 adress and printing the stack when I hit it using the command pxr @ esp The result was :

0xffe4a170 0xffe4a184 .... @esp stack R W 0x9f61c8c --> (Here_you_have_to_understand_a_little_C++_stuffs) 0xffe4a174 0xffe4b367 g... edx stack R W 0x43007373 (ss) --> ascii

So now, I would like to solve this challenge again in a different way. I have two questions.

First question : At first, before solve it by this way, I tried to put breakpoint on each comparaison function and my idea was to change the rip adress like in this video. The problem in my case is when I enter the command dr, I don't have the rip adress. This is the output I have :

hit breakpoint at: 8048b99
[0x08048b99]> dr
eax = 0xffffff00
ebx = 0xffceafa0
ecx = 0x00000004
edx = 0xffceb365
esi = 0xf7d54000
edi = 0xf7d54000
esp = 0xffceaf60
ebp = 0xffceaf88
eip = 0x08048b99
eflags = 0x00000246
oeax = 0xffffffff

Why I don't have the rip value ? Can you explain me how can I do that if is it possible ?

Second question : Is there a command in radare2 which I don't know and which allows me to print directly the value of obj._ZSt4cout__GLIBCXX_3.4

Improve this question
1
  • 2
    rip is the 64 bit instruction pointer only available on x64. Your binary seems to be x86, eip is the x86 instruction pointer. Try changing eip in a similar way. Read up on different registers available on both c86 and x64.
    – sudhackar
    Jan 9, 2019 at 3:24

1 Answer 1

Reset to default
3

rip = x64 eip = x86 dr shows eip in your case

it is probably some demangled name (not sure why radare2 inserts the GLIBC part )

but if you strip the GLIBC part you can use iD Command to demangle it to std::cout

[0x01012d6c]> iD cxx _ZSt4cout__GLIBCXX_3.4
[0x01012d6c]> iD cxx _ZSt4cout__GLIBCXX_
[0x01012d6c]> iD cxx _ZSt4cout__GLIBCXX
[0x01012d6c]> iD cxx _ZSt4cout__GLIBC
[0x01012d6c]> iD cxx _ZSt4cout__GL
[0x01012d6c]> iD cxx _ZSt4cout__
[0x01012d6c]> iD cxx _ZSt4cout_
[0x01012d6c]> iD cxx _ZSt4cout
std::cout
[0x01012d6c]> iD cxx _ZSt4cou
[0x01012d6c]>

btw i don't know why you get all that unintelligible thingies

did you analyse the executable prior to loading or after loading it ?

radare2 does a better job than what you posted as a result of pdf

just so i wasn't deceived by some long forgotten memory i ran through hoops to fetch the 4th challenge :( and loaded it in radare2 and i am sure it really does a better job than you posted in case after analysis you don't get intelligible output check

e asm.demangle and set it to true reanlyze and do pdf

here is a screenshot the first _Z blah blah in your screen shot is std::cerr auto demangled by radare2

enter image description here

my radare2 version atm is 2.8.xxx i see latest is 3.2.xxx if the latest version differs in output try contacting the radare2 team maybe someone from the team or a more avid user like megabeets might chime here too

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.