0

I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as sym.xxx. The following listing is trimmed version of disassembled output of the function sym.xxx.

[0x7ff299821090]> pdf @sym.xxx
/ (fcn) sym.xxx 179
|   sym.xxx ();
|           ; CALL XREF from main @ 0x55a340b531a8
|           0x55a340b53297      55             push rbp
|           0x55a340b53298      4889e5         mov rbp, rsp
|           0x55a340b5329b      488d35b92d00.  lea rsi, obj.key3       ; 0x55a340b5605b ; "is"
|           0x55a340b532a2      488d3d373000.  lea rdi, [0x55a340b562e0]
|           0x55a340b532a9      e8c2fdffff     call sym.imp.strcat     ; char *strcat(char *s1, const char *s2)
|           0x55a340b532ae      488d052b3000.  lea rax, [0x55a340b562e0]
|           0x55a340b532b5      48c7c1ffffff.  mov rcx, 0xffffffffffffffff
|           0x55a340b532bc      4889c2         mov rdx, rax
|           0x55a340b532bf      b800000000     mov eax, 0
|           0x55a340b532c4      4889d7         mov rdi, rdx
|           0x55a340b532c7      f2ae           repne scasb al, byte [rdi]
...

While stepping in through each instruction in this function, I have noticed that after executing the fourth instructon (lea rdi, [0x55a340b562e0]) the 2nd operand of lea instruction automatically substituted to a random register like rdx, r9, rdi in the disassembly of debugger window. In the screenshot below the fourth instruction got substituted to lea rdi, [rdi] by radare2. And I think it is worth mentioning that I have loaded the crackme executable 5 times in radare2, at first two times radare2 replaced the memory address operand with rdx and r9 and last 3 times with rdi.

enter image description here

I am quite unsure of what causing this behavior.Although lea rdi, [rdi] looks self-explanatory but I don't know about rdx or r9. Why radare2 is changing memory operands in lea instruction ?

Radare2 version : radare2 3.7.0 22507 @ linux-x86-64 git.3.7.0-38-g9ce44c7cc

Crackme binary: https://crackmes.one/crackme/5c95646333c5d46ecd37c960

  • rdx, r9 and rdi aren’t random registers. In x64 Linux they contain 3rd, 6th and 1st argument of a function respectively. Maybe there are several versions of this function and each one uses a different argument to initialise rdi before a call to strcat? – bart1e Aug 15 at 19:20
  • Actually the function xxx gets called from main without any argument passed to it. The purpose of this function to generate a password. There is only one version of this function. – mapper2496 Aug 16 at 12:08
  • 1
    Could you share the binary? – bart1e Aug 16 at 17:58
  • @bart1e Here is the link crackmes.one/crackme/5c95646333c5d46ecd37c960 – mapper2496 Aug 16 at 18:56
0

The instruction that confuses you is 488d3d37300000 standing for lea rdi,[rip+0x3037].

What radare2 shows you before executing this instruction is the value that will be stored in rdi register, not the exact mnemonic of the instruction. After executing this line, you see lea rdi, [rdi] and the reason behind it, I guess, is that radare2 prefers to show registers instead of raw values when possible. After executing this instruction, it realises that rdi has in fact value 0x55e3a3b802e0 so it can display it instead, which usually would be more readable, but in your case it unfortunately leads to confusion.

To make sure that it is just radare2 issue, not the executable itself, you may check the opcode just before executing that instruction and just after it - it doesn't change.

Note: You mentioned that you see different registers in lea - they aren't put there randomly; depending on the current register values when you look at the mnemonics (using pdf or Visual Mode), they will change; i.e. if r9= 0x55a340b562e0 at some moment, it can be displayed there (so you will see lea rdi, [r9] when it happens that r9 or any other register has that value).

  • Thank you. Later I also noticed that mnemonics change depending on register value. Your answer made it more clear . – mapper2496 Aug 18 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.