1

i am trying to find the password of a binary with radare2 - a crackme again :-)

I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn't found out yet...

Here is the code and my thoughts about it:

/ (fcn) sym.main 134
|   int sym.main (int argc, char **argv, char **envp);
|           ; var int var_dh @ rbp-0xd
|           ; var int var_9h @ rbp-0x9
|           ; var int var_8h @ rbp-0x8
|           ; DATA XREF from entry0 (0x6dd)
|           0x000008bc      55             push rbp
|           0x000008bd      4889e5         mov rbp, rsp
|           0x000008c0      4883ec10       sub rsp, 0x10

Memory Set-Up

|           0x000008c4      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x1a30 ; '('
|           0x000008cd      488945f8       mov qword [var_8h], rax
|           0x000008d1      31c0           xor eax, eax
|           0x000008d3      c745f3000000.  mov dword [var_dh], 0
|           0x000008da      c645f700       mov byte [var_9h], 0
|           0x000008de      488d3d140100.  lea rdi, qword str.Enter__pass__: ; 0x9f9 ; "Enter \"pass\":  "
|           0x000008e5      e896fdffff     call sym.imp.puts           ; int puts(const char *s)

Set up var_dh, var_9 and var_8h = 0, Display message 'Enter "pass":'

|           0x000008ea      488b151f0720.  mov rdx, qword [obj.stdin]  ; obj.__TMC_END ; [0x201010:8]=0
|           0x000008f1      488d45f3       lea rax, qword [var_dh]
|           0x000008f5      be05000000     mov esi, 5
|           0x000008fa      4889c7         mov rdi, rax
|           0x000008fd      e89efdffff     call sym.imp.fgets          ; char *fgets(char *s, int size, FILE *stream)

Get user input

|           0x00000902      488d45f3       lea rax, qword [var_dh]
|           0x00000906      ba04000000     mov edx, 4
|           0x0000090b      488d35030100.  lea rsi, qword str.pass     ; 0xa15 ; "pass"
|           0x00000912      4889c7         mov rdi, rax
|           0x00000915      e856fdffff     call sym.imp.strncmp        ; int strncmp(const char *s1, const char *s2, size_t n)
|           0x0000091a      85c0           test eax, eax

Compare user input with "pass"

|           0x0000091c      90             nop
|           0x0000091d      b800000000     mov eax, 0
|           0x00000922      90             nop
|           0x00000923      90             nop
|           0x00000924      90             nop
|           0x00000925      90             nop
|           0x00000926      90             nop
|           0x00000927      b800000000     mov eax, 0
|           0x0000092c      488b4df8       mov rcx, qword [var_8h]
|           0x00000930      6448330c2528.  xor rcx, qword fs:[0x28]
|       ,=< 0x00000939      7405           je 0x940
|       |   0x0000093b      e850fdffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
|       |   ; CODE XREF from sym.main (0x939)
|       `-> 0x00000940      c9             leave
\           0x00000941      c3             ret

Leave program, when password is wrong?!

Maybe I just can't see the wood for the trees...

  • The binary looks to have been manually patched. Compilers generally do not emit NOP except for alignment purpose. And mov eax, 0 in the last block will always make it return 0 irrespective of the password supplied. – 0xec Feb 12 at 10:52
  • Welcome to RE.SE! Could you perhaps reference the binary? – Nordwald Feb 12 at 10:57
  • Here you go: link – Mofro Feb 12 at 11:58
  • 2
    @Mofro This check is dummy. Its not a check at all. Try to look at output of afl – sudhackar Feb 12 at 16:07
  • 1
    Thanks a lot! I could find the flag. – Mofro Feb 13 at 11:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.