I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
Following quote comes from unix.stackexchange:
To patch a file means to modify it, with the connotation that the modification is generally small.
So, patching the executable is a process of changing its content usually performed for changing its original behaviour.
Patching is obviously not allowed means that the author of a particular crackme wants you to crack it without modifying its content. For instance, consider a simple program:
ask_user_for_password(); read_input(); if (isPasswordCorrect()) printf(“Congratulations, you have cracked it!\n”); else printf(“Wrong password! Try again!\n”);
Of course one can patch it so that it always prints the "Congratulations [...]" message, but the point of this very simple crackme is to actually find that password somehow (by finding decryption key for example).
Generally, to patch a file, you want to:
- Find the place / instruction you want to change (it may be
jzas @Axel Munoz said, but it may be a
jmpto the location containing the code you want to be executed as well).
- Find out what is the machine code representing the instruction you want to put there - it can be done by first compiling the program written in assembly and then disassembling it. If you are working on x86 architecture, you can use this site as well.
- Open the binary in a hex editor, find the offset where you want to put your code and just paste the machine code you obtained in the previous step.
The term "patching a [binary]" means to modify the instruction set. For example if there is a conditional jump that requires some memory to be set to a specific value, instead of modifying the memory, which might be the objective of the crackme, I could simply patch the binary to always take that jump (either by changing the condition of the jump from
jz). Patching through a debugger easily allows me to change the instruction, save the new binary, and then run it.
2You are pretty inaccurate by saying that patching means modifying instruction set, but link is good.– CrollAug 14, 2019 at 10:33
I honestly never understood the point of inverting the condition (
jz). It seems odd to change one conditional jump into another conditional jump when an altogether unconditional jump exists ...– 0xC0000022L ♦Aug 14, 2019 at 10:57
@0xC0000022L It may be useful when there is a bug in the program and you want to invert an if-else block for example to fix it. But I agree it’s rather rare case.– bart1eAug 14, 2019 at 11:04
@Croll I agree it's not the best way to phrase, how would you put it? Aug 14, 2019 at 11:17
1I know what you mean (modifying code/logic in the binary), but "instruction set" refers to the set of instructions recognized by a CPU and is tied together with CPU architecture. For example the x86 instruction set is different from the MIPS instruction set– julian ♦Aug 14, 2019 at 12:42
LD_PRELOADand friends? ...
LD_PRELOADis a beautiful thing. I forgot to mention that the reason it is usually acceptable is that if DLL injection is something the crackme author is concerned about, they will provide a statically-linked binary rather than saying "No LD_PRELOAD".