I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has access.
I can see from the executable's main function through radare2 that there is a "login" section that asks for a password and this then proceeds to execute a system command that prints the restricted file.
However, it seems the program flow skips past this section and terminates the program.
Given an address or a string reference, how can I use radare2 to execute the program from a certain point so that I can avoid skipping it?
From this:
entry point 0x00000
|
| desired section 0x000c8 "enter password: "
v
termination 0x000f9 "no entry"
To this:
entry point
|
|_-> desired section 0x000c8 "enter password: " -> 0x000ca "cat /root/file.txt" -
|
termination 0x000f9 <-___________________________________________________________|
rip
to the desired address? – Paweł Łukasik Oct 5 '20 at 6:12rip
differ from seek? – Gabriel Saul Oct 7 '20 at 1:55rip
to the desired address and continued execution withdc
and it ended up terminating prematurely with a memory error. – Gabriel Saul Oct 8 '20 at 0:33