2

I have a file named exploit.c inside which:

#include <stdbool.h>
#include <stdio.h>

const char y1 = 'a';
const char y2 = 'b';
const char y3 = 'x';
const char y4 = 'y';
const char y5 = 'i';
const char y6 = 'j';

char x1 = 'f' ^ 'a';
char x2 = 'l' ^ 'b';
char x3 = 'a' ^ 'x';
char x4 = 'g' ^ 'y';
char x5 = 'y' ^ 'i';
char x6 = '-' ^ 'j';

int main() {
  bool c = false;
  if(c) { printf("The flag is: %c%c%c%c%c%c%c%c%c%c%c\n", x1 ^ y1, x2 ^ y2, x3 ^ y3, x4 ^
y4, x4 ^ y4, x5 ^ y5, x6 ^ y6, x1 ^ y1, x2 ^ y2, x3 ^ y3, x4 ^ y4); }
  return 0;
}

How can I print out the flag without changing the value of boolean but with gcc and gdb?

4
  • f^a^a = f and so on flaggy-flag is spottable visually – blabb Apr 14 at 18:36
  • Do you assume that you don't have the sources or debug symbols? – Dvd848 Apr 14 at 18:56
  • We assume that at least we have executable files – Mark Ezberg Apr 15 at 2:23
  • You'd also need to assume that it has been compiled without optimisations; otherwise the executable would likely contain no remnants of the flag at all – Ian Cook Apr 20 at 7:24
0

The if statement is likely compiled into a conditional jump so you just need to step until the comparison and change the result. For example, if the jump is je or jne, you need to change the zero flag (ZF) to force the jump in the opposite direction.

For changing flags in GDB, see

https://stackoverflow.com/a/31339372

Another option is to change the instruction pointer ($rip or $eip) to the location which corresponds to the if body.

0

It was pretty easy one so I could do myself:) We have exploit.c file where I need to debug it in order to get the flag with 'gcc'. I run the program with:

gcc -g exploit.c -o exploit and got 'exploit' which is executable exploit.c file.

Then: gdb exploit

We have bool c = false; on line 21, so put the break line on it:

break 21

Then: I changed the value of c by this command: set variable c = true However, when I went to the next line by “next” it become false again. So I reset the value again: set variable c = “true”` and then next button: Yay, it printed out the flag:

(gdb) next

The flag is: flaggy-flag
23    return 0;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.