I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra looks like :
undefined4 main(undefined4 param_1,undefined4 param_2,undefined4 param_3)
{
undefined local_7c [120];
printf("IOLI Crackme Level 0x06\n");
printf("Password: ");
scanf("%s",local_7c);
check(local_7c,param_3);
return 0;
}
Intel x86 looks like :
**************************************************************
* FUNCTION *
**************************************************************
undefined main(undefined param_1, undefined param_2, und
undefined AL:1 <RETURN>
undefined Stack[0x4]:1 param_1
undefined Stack[0x8]:1 param_2
undefined4 Stack[0xc]:4 param_3 XREF[1]: 08048651(R)
undefined[120] Stack[-0x7c] local_7c XREF[2]: 0804863e(*),
08048658(*)
undefined4 Stack[-0x9c]:4 local_9c XREF[2]: 08048641(W),
08048654(W)
undefined4 Stack[-0xa0]:4 local_a0 XREF[4]: 08048626(*),
08048632(*),
08048645(*),
0804865b(*)
main XREF[2]: Entry Point(*),
_start:08048417(*)
08048607 55 PUSH EBP
08048608 89 e5 MOV EBP,ESP
0804860a 81 ec 88 SUB ESP,0x88
00 00 00
08048610 83 e4 f0 AND ESP,0xfffffff0
08048613 b8 00 00 MOV EAX,0x0
00 00
08048618 83 c0 0f ADD EAX,0xf
0804861b 83 c0 0f ADD EAX,0xf
0804861e c1 e8 04 SHR EAX,0x4
08048621 c1 e0 04 SHL EAX,0x4
08048624 29 c4 SUB ESP,EAX
08048626 c7 04 24 MOV dword ptr [ESP]=>local_a0,s_IOLI_Crackme_Level = "IOLI Crackme Level 0x06\n"
63 87 04 08
0804862d e8 86 fd CALL printf int printf(char * __format, ...)
ff ff
08048632 c7 04 24 MOV dword ptr [ESP]=>local_a0,s_Password:_0804877c = "Password: "
7c 87 04 08
08048639 e8 7a fd CALL printf int printf(char * __format, ...)
ff ff
0804863e 8d 45 88 LEA EAX=>local_7c,[EBP + -0x78]
08048641 89 44 24 04 MOV dword ptr [ESP + local_9c],EAX
08048645 c7 04 24 MOV dword ptr [ESP]=>local_a0,DAT_08048787 = 25h %
87 87 04 08
0804864c e8 47 fd CALL scanf int scanf(char * __format, ...)
ff ff
08048651 8b 45 10 MOV EAX,dword ptr [EBP + param_3]
08048654 89 44 24 04 MOV dword ptr [ESP + local_9c],EAX
08048658 8d 45 88 LEA EAX=>local_7c,[EBP + -0x78]
0804865b 89 04 24 MOV dword ptr [ESP]=>local_a0,EAX
0804865e e8 25 ff CALL check undefined check(undefined4 param
ff ff
08048663 b8 00 00 MOV EAX,0x0
00 00
08048668 c9 LEAVE
08048669 c3 RET
My Question is what is "check" keyword? I have run ltrace and strace on the binary, so I know its neither some library function nor system-call. What is it then?
check
is the name of the function which checks the correctness of the password. If you double click on it in Ghidra, it should take you to its location. – 0xec Mar 31 '20 at 7:05