0

So, i downloaded the binary. Here are some details before moving forward:

revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=2f0bc3cfa6ec6a297f58ae75f8802bd1b5ef7162, not stripped

        linux-vdso.so.1 (0x00007fffec358000)
        libmariadb.so.3 => /lib/x86_64-linux-gnu/libmariadb.so.3 (0x00007f1d76fbe000)
        libcrypto.so.1.1 => /lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f1d76cd2000)
        libzip.so.4 => /lib/x86_64-linux-gnu/libzip.so.4 (0x00007f1d76cb7000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1d76af2000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f1d76ad0000)
        libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f1d76ab3000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f1d76aab000)
        libgnutls.so.30 => /lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007f1d768e1000)
        libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007f1d768ce000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f1d7703c000)
        libp11-kit.so.0 => /lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f1d7679a000)
        libidn2.so.0 => /lib/x86_64-linux-gnu/libidn2.so.0 (0x00007f1d76779000)
        libunistring.so.2 => /lib/x86_64-linux-gnu/libunistring.so.2 (0x00007f1d765f5000)
        libtasn1.so.6 => /lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007f1d765df000)
        libnettle.so.8 => /lib/x86_64-linux-gnu/libnettle.so.8 (0x00007f1d7659f000)
        libhogweed.so.6 => /lib/x86_64-linux-gnu/libhogweed.so.6 (0x00007f1d76556000)
        libgmp.so.10 => /lib/x86_64-linux-gnu/libgmp.so.10 (0x00007f1d764d3000)
        libffi.so.7 => /lib/x86_64-linux-gnu/libffi.so.7 (0x00007f1d764c7000)

So, as you can see it depends upon libcrypto.so which is i think openssl library. Now debugging a a function called from main, named process_data has this code as ghidra gave with some modification: process_data_code

Now, i know upto md5 part that it get data from message table and stores a row....... So, i came to md5sum part, its passing the variables to md5sum but i dont know what are the functions of md5sum parameters. If it were libc functions like snprintf or fputs i could see manpage or try googling but it didnt give me nice results. This stackoverflow answer

Stackoverflow says the first parameter is password, second is length of password and third is some weird shit. So, if you see the code you will get md5sum has 4 parameters

md5sum(random_mysql_rows_bufarray,mysql_rows_buffer_length & 0xffffffff, filename_ofvarlocal, mysql_rows_buffer_length & 0xffffffff);

Also, that answer says md5sum having 4 parameter isnt openssl md5. I just want to figure out what is the function of those 4 parameters in md5sum. Also if you could explain what is the weird & 0xfffffff thing then it would be great! Here's the binary : reverse binary

Yeah, md5sum takes 4 parameter, got it.

1
  • remove the image and link the query and according to that query it was a mistake and was edited later to show only three arguments openssl.md5sum takes 3 arguments only remove words that are not usable in a public site from your query thethird argument is a pointer to the returned hashvalue a char buffer[] – blabb Oct 2 '20 at 21:00
0

the file command says the binary is unstripped you shouldn't have much problem identifying the arguments

the &0xffffffff is a mask to get a 32 bit value from a 64 bit value

for example if a function is proto typed as ulong64 foo(ulong64 a, ulong b);

as x64 calling convention uses 6 registers in linux system ABI RDI, RSI, RDX, RCX, R8, and R9 you cannot simply pass rsi without zeroing the upper 32 bits

the & 0xffffffff zeros the upper 32 bits of 64 bit register

>>> a = 0x123456789abcdef0
>>> b = a & 0xffffffff
>>> print("val32=%016x\nval64=%016x\n" % (b,a))
val32=000000009abcdef0
val64=123456789abcdef0 

if the line you pasted is from ghidra then ghidra might be mistaking the use of a register you can over ride the function signature

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.