3

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the program to make it print the password if strcmp fails.

  • The password is stored in local_40

But I don't know how to patch the instruction to print out the value at local_40

Instead of MOV dword ptr [ESP],0x4b1050 what variable in this instruction should be edited? If my understanding is correct then the above instruction is loading the ESP register with the value at 0x4b1050 so how will I get the address of local_40?

enter image description here

Improve this question
3
  • Are you sure you want to patch the program in order to discover the password? It would probably be easier to use a debugger or ltrace for this matter.
    – Dvd848
    Commented May 20, 2021 at 16:29
  • I'll resort to that if this didn't work, but just to learn this stuff, some help is appreciated
    – Nimrod
    Commented May 20, 2021 at 16:51
  • 1
    I'm guessing that you can try something like LEA EAX, [EBP - 0x3c]; MOV dword ptr [ESP], EAX (notice that local_40 is actually EBP - 0x3c). You'll need to override some instructions before 0x40151a as well, and therefore to point the JNZ accordingly.
    – Dvd848
    Commented May 20, 2021 at 17:53

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.