0

I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through memfrob to compare to the string that the user inputs.

I'm trying to either debug the binary to run until the point after the memfrob was called and the value is stored in a register to view its value or take the value from the assembly that I found and run that through memfrob in my own C script.

I'm having trouble finding an explanation on how to do it the first way and when I try to run memfrob on my own in C it tells me "implicit declaration of function 'memfrob'" but I am including string.h.

#include <string.h>
int main(void)
{

    char check[20] = {0x5f,
    0x40,
    0x5a,
    0x15,
    0x75,
    0x45,
    0x62,
    0x53,
    0x75,
    0x46,
    0x52,
    0x43,
    0x5f,
    0x75,
    0x50,
    0x52,
    0x75,
    0x5f,
    0x5c,
    0x4f};

    for (int i = 0; i < 20; i++)
    {
        printf("%x",check);
    }

    memfrob(&check,0x14);

    
    
    return 0;
}

I'm not sure what the correct way to go about this is, but so far I've had no success with either.

I have also tried running it through things like CyberChef to decrypt the XOR42 from memfrob but that also ended up giving me nothing useful

3
  • What system/compiler are you using? You can just implement yourself if you cant link against it. code.woboq.org/userspace/glibc/string/memfrob.c.html
    – mumbel
    Aug 23 at 20:29
  • This can be easily done with a debugger but would need more details, what is the operating system, what CPU architecture is the binary etc Aug 24 at 2:10
  • I have fixed your code a bit ideone.com/18I7rp See if this helps. If you need to look at the registers you'll probably need to get it under a debugger and set breakpoints on where you want to examine it.
    – sudhackar
    Aug 26 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.