I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
2 Answers
Following quote comes from unix.stackexchange:
To patch a file means to modify it, with the connotation that the modification is generally small.
So, patching the executable is a process of changing its content usually performed for changing its original behaviour.
Patching is obviously not allowed means that the author of a particular crackme wants you to crack it without modifying its content. For instance, consider a simple program:
ask_user_for_password();
read_input();
if (isPasswordCorrect())
printf(“Congratulations, you have cracked it!\n”);
else
printf(“Wrong password! Try again!\n”);
Of course one can patch it so that it always prints the "Congratulations [...]" message, but the point of this very simple crackme is to actually find that password somehow (by finding decryption key for example).
Generally, to patch a file, you want to:
- Find the place / instruction you want to change (it may be
jnz
tojz
as @Axel Munoz said, but it may be ajmp
to the location containing the code you want to be executed as well). - Find out what is the machine code representing the instruction you want to put there - it can be done by first compiling the program written in assembly and then disassembling it. If you are working on x86 architecture, you can use this site as well.
- Open the binary in a hex editor, find the offset where you want to put your code and just paste the machine code you obtained in the previous step.
The term "patching a [binary]" means to modify the instruction set. For example if there is a conditional jump that requires some memory to be set to a specific value, instead of modifying the memory, which might be the objective of the crackme, I could simply patch the binary to always take that jump (either by changing the condition of the jump from jnz
to jz
). Patching through a debugger easily allows me to change the instruction, save the new binary, and then run it.
-
2You are pretty inaccurate by saying that patching means modifying instruction set, but link is good.– CrollAug 14, 2019 at 10:33
-
I honestly never understood the point of inverting the condition (
jnz
tojz
). It seems odd to change one conditional jump into another conditional jump when an altogether unconditional jump exists ...– 0xC0000022L ♦Aug 14, 2019 at 10:57 -
@0xC0000022L It may be useful when there is a bug in the program and you want to invert an if-else block for example to fix it. But I agree it’s rather rare case.– bart1eAug 14, 2019 at 11:04
-
@Croll I agree it's not the best way to phrase, how would you put it? Aug 14, 2019 at 11:17
-
1I know what you mean (modifying code/logic in the binary), but "instruction set" refers to the set of instructions recognized by a CPU and is tied together with CPU architecture. For example the x86 instruction set is different from the MIPS instruction set– julian ♦Aug 14, 2019 at 12:42
LD_PRELOAD
and friends? ...LD_PRELOAD
)LD_PRELOAD
is a beautiful thing. I forgot to mention that the reason it is usually acceptable is that if DLL injection is something the crackme author is concerned about, they will provide a statically-linked binary rather than saying "No LD_PRELOAD".