1

I have a file crackme, which is an executable.

hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme 
crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=5418569f8ce35c5b188b0a4f13e79f4a611ee54e, stripped

I tried to follow the instructions of the solution of the bellow question.
Reversing ELF 64-bit LSB executable, x86-64 ,gdb

Sadly, I have a problem and I can't find a solution.
What I did:

hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ gdb crackme -q
Reading symbols from crackme...
(No debugging symbols found in crackme)
gdb$ info files
Symbols from "/home/hamuto/Security/NOOB/FruitSalad/crackme".
Local exec file:
    `/home/hamuto/Security/NOOB/FruitSalad/crackme', file type elf64-x86-64.
    Entry point: 0x22b0
    0x00000000000002a8 - 0x00000000000002c4 is .interp
    0x00000000000002c4 - 0x00000000000002e4 is .note.ABI-tag
    0x00000000000002e4 - 0x0000000000000308 is .note.gnu.build-id
    0x0000000000000308 - 0x0000000000000340 is .gnu.hash
    0x0000000000000340 - 0x0000000000000850 is .dynsym
    0x0000000000000850 - 0x00000000000010d4 is .dynstr
    0x00000000000010d4 - 0x0000000000001140 is .gnu.version
    0x0000000000001140 - 0x00000000000011f0 is .gnu.version_r
    0x00000000000011f0 - 0x0000000000001508 is .rela.dyn
    0x0000000000001508 - 0x00000000000018b0 is .rela.plt
    0x0000000000002000 - 0x0000000000002017 is .init
    0x0000000000002020 - 0x00000000000022a0 is .plt
    0x00000000000022a0 - 0x00000000000022a8 is .plt.got
    0x00000000000022b0 - 0x0000000000009b81 is .text
    0x0000000000009b84 - 0x0000000000009b8d is .fini
    0x000000000000a000 - 0x000000000000a2da is .rodata
    0x000000000000a2dc - 0x000000000000ae90 is .eh_frame_hdr
    0x000000000000ae90 - 0x000000000000df70 is .eh_frame
    0x000000000000df70 - 0x000000000000e25c is .gcc_except_table
    0x000000000000fd10 - 0x000000000000fd28 is .init_array
    0x000000000000fd28 - 0x000000000000fd30 is .fini_array
    0x000000000000fd30 - 0x000000000000fdb8 is .data.rel.ro
    0x000000000000fdb8 - 0x000000000000ffc8 is .dynamic
    0x000000000000ffc8 - 0x0000000000010000 is .got
    0x0000000000010000 - 0x0000000000010150 is .got.plt
    0x0000000000010150 - 0x000000000001016c is .data
    0x0000000000010180 - 0x00000000000103f0 is .bss
gdb$ 

As you can see the entry point is at 0x22b0. If I try to create a breakpoint and run :

gdb$ break *0x22b0
Breakpoint 1 at 0x22b0
gdb$ r
Starting program: /home/hamuto/Security/NOOB/FruitSalad/crackme 

[1]+  Arrêté                gdb crackme -q
hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ 

The program actually get to the background, I can get it back with the command fg:

hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ fg
gdb crackme -q
Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0x22b0

It is still strange, that gdb went to the background, but that's not all if I try to disassemble the entry point, with a size of 50:

gdb$ disas 0x22b0,+50
Dump of assembler code from 0x22b0 to 0x2300:
   0x00000000000022b0:  Cannot access memory at address 0x22b0

It doesn't work, I must be missing something. Thank you for your help.

2
  • the problem is ASLR, see linked dupe
    – Igor Skochinsky
    May 9 '19 at 8:25
  • Thanks, I just need some help to know where to search. :)
    – Hamza Ince
    May 9 '19 at 8:26

Browse other questions tagged or ask your own question.