0

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra looks like :

undefined4 main(undefined4 param_1,undefined4 param_2,undefined4 param_3)
{
  undefined local_7c [120];

  printf("IOLI Crackme Level 0x06\n");
  printf("Password: ");
  scanf("%s",local_7c);
  check(local_7c,param_3);
  return 0;
}

Intel x86 looks like :

                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             undefined main(undefined param_1, undefined param_2, und
             undefined         AL:1           <RETURN>
             undefined         Stack[0x4]:1   param_1
             undefined         Stack[0x8]:1   param_2
             undefined4        Stack[0xc]:4   param_3                                 XREF[1]:     08048651(R)  
             undefined[120]    Stack[-0x7c]   local_7c                                XREF[2]:     0804863e(*), 
                                                                                                   08048658(*)  
             undefined4        Stack[-0x9c]:4 local_9c                                XREF[2]:     08048641(W), 
                                                                                                   08048654(W)  
             undefined4        Stack[-0xa0]:4 local_a0                                XREF[4]:     08048626(*), 
                                                                                                   08048632(*), 
                                                                                                   08048645(*), 
                                                                                                   0804865b(*)  
                             main                                            XREF[2]:     Entry Point(*), 
                                                                                          _start:08048417(*)  
        08048607 55              PUSH       EBP
        08048608 89 e5           MOV        EBP,ESP
        0804860a 81 ec 88        SUB        ESP,0x88
                 00 00 00
        08048610 83 e4 f0        AND        ESP,0xfffffff0
        08048613 b8 00 00        MOV        EAX,0x0
                 00 00
        08048618 83 c0 0f        ADD        EAX,0xf
        0804861b 83 c0 0f        ADD        EAX,0xf
        0804861e c1 e8 04        SHR        EAX,0x4
        08048621 c1 e0 04        SHL        EAX,0x4
        08048624 29 c4           SUB        ESP,EAX
        08048626 c7 04 24        MOV        dword ptr [ESP]=>local_a0,s_IOLI_Crackme_Level   = "IOLI Crackme Level 0x06\n"
                 63 87 04 08
        0804862d e8 86 fd        CALL       printf                                           int printf(char * __format, ...)
                 ff ff
        08048632 c7 04 24        MOV        dword ptr [ESP]=>local_a0,s_Password:_0804877c   = "Password: "
                 7c 87 04 08
        08048639 e8 7a fd        CALL       printf                                           int printf(char * __format, ...)
                 ff ff
        0804863e 8d 45 88        LEA        EAX=>local_7c,[EBP + -0x78]
        08048641 89 44 24 04     MOV        dword ptr [ESP + local_9c],EAX
        08048645 c7 04 24        MOV        dword ptr [ESP]=>local_a0,DAT_08048787           = 25h    %
                 87 87 04 08
        0804864c e8 47 fd        CALL       scanf                                            int scanf(char * __format, ...)
                 ff ff
        08048651 8b 45 10        MOV        EAX,dword ptr [EBP + param_3]
        08048654 89 44 24 04     MOV        dword ptr [ESP + local_9c],EAX
        08048658 8d 45 88        LEA        EAX=>local_7c,[EBP + -0x78]
        0804865b 89 04 24        MOV        dword ptr [ESP]=>local_a0,EAX
        0804865e e8 25 ff        CALL       check                                            undefined check(undefined4 param
                 ff ff
        08048663 b8 00 00        MOV        EAX,0x0
                 00 00
        08048668 c9              LEAVE
        08048669 c3              RET

My Question is what is "check" keyword? I have run ltrace and strace on the binary, so I know its neither some library function nor system-call. What is it then?

  • check is the name of the function which checks the correctness of the password. If you double click on it in Ghidra, it should take you to its location. – 0xec Mar 31 at 7:05
  • Thanks for the suggestion. I just realized and found check has its own definition. Rookie mistake I guess. – Prithi Mar 31 at 7:36
1

check is a symbol name inside your binary - meaning it's just a name of the function the Ghidra can recognize.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.