1

i am trying to find the password of a binary with radare2 - a crackme again :-)

I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn't found out yet...

Here is the code and my thoughts about it:

/ (fcn) sym.main 134
|   int sym.main (int argc, char **argv, char **envp);
|           ; var int var_dh @ rbp-0xd
|           ; var int var_9h @ rbp-0x9
|           ; var int var_8h @ rbp-0x8
|           ; DATA XREF from entry0 (0x6dd)
|           0x000008bc      55             push rbp
|           0x000008bd      4889e5         mov rbp, rsp
|           0x000008c0      4883ec10       sub rsp, 0x10

Memory Set-Up

|           0x000008c4      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x1a30 ; '('
|           0x000008cd      488945f8       mov qword [var_8h], rax
|           0x000008d1      31c0           xor eax, eax
|           0x000008d3      c745f3000000.  mov dword [var_dh], 0
|           0x000008da      c645f700       mov byte [var_9h], 0
|           0x000008de      488d3d140100.  lea rdi, qword str.Enter__pass__: ; 0x9f9 ; "Enter \"pass\":  "
|           0x000008e5      e896fdffff     call sym.imp.puts           ; int puts(const char *s)

Set up var_dh, var_9 and var_8h = 0, Display message 'Enter "pass":'

|           0x000008ea      488b151f0720.  mov rdx, qword [obj.stdin]  ; obj.__TMC_END ; [0x201010:8]=0
|           0x000008f1      488d45f3       lea rax, qword [var_dh]
|           0x000008f5      be05000000     mov esi, 5
|           0x000008fa      4889c7         mov rdi, rax
|           0x000008fd      e89efdffff     call sym.imp.fgets          ; char *fgets(char *s, int size, FILE *stream)

Get user input

|           0x00000902      488d45f3       lea rax, qword [var_dh]
|           0x00000906      ba04000000     mov edx, 4
|           0x0000090b      488d35030100.  lea rsi, qword str.pass     ; 0xa15 ; "pass"
|           0x00000912      4889c7         mov rdi, rax
|           0x00000915      e856fdffff     call sym.imp.strncmp        ; int strncmp(const char *s1, const char *s2, size_t n)
|           0x0000091a      85c0           test eax, eax

Compare user input with "pass"

|           0x0000091c      90             nop
|           0x0000091d      b800000000     mov eax, 0
|           0x00000922      90             nop
|           0x00000923      90             nop
|           0x00000924      90             nop
|           0x00000925      90             nop
|           0x00000926      90             nop
|           0x00000927      b800000000     mov eax, 0
|           0x0000092c      488b4df8       mov rcx, qword [var_8h]
|           0x00000930      6448330c2528.  xor rcx, qword fs:[0x28]
|       ,=< 0x00000939      7405           je 0x940
|       |   0x0000093b      e850fdffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
|       |   ; CODE XREF from sym.main (0x939)
|       `-> 0x00000940      c9             leave
\           0x00000941      c3             ret

Leave program, when password is wrong?!

Maybe I just can't see the wood for the trees...

  • The binary looks to have been manually patched. Compilers generally do not emit NOP except for alignment purpose. And mov eax, 0 in the last block will always make it return 0 irrespective of the password supplied. – 0xec Feb 12 at 10:52
  • Welcome to RE.SE! Could you perhaps reference the binary? – Nordwald Feb 12 at 10:57
  • Here you go: link – Mofro Feb 12 at 11:58
  • 2
    @Mofro This check is dummy. Its not a check at all. Try to look at output of afl – sudhackar Feb 12 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.