1

I am trying to solve crackme. But I have no experience with obfuscation and anti-debugging protection. Crackme just asks for flag and prompts it is incorrect. In debbuger it always crashes with segmentation fault:

 [+] SIGNAL 11 errno=0 addr=0x00000000 code=1 si_pid=0 ret=0

Or in gdb:

Program received signal SIGSEGV, Segmentation fault.
0x08049094 in ?? ()
(gdb) x/i $pc
=> 0x8049094:   mov    (%eax),%eax
(gdb) Quit
(gdb)

Code has only one function entry0 and most of the code looks like a lot of actions with random address.

0x080483a0    1      6 sym.imp.sigaction
0x08048340    1      6 sym.imp.read
0x08048360    1      6 sym.imp.puts
0x08048380    1      6 sym.imp.strlen
0x08048390    1      6 sym.imp.setvbuf
0x08048350    1      6 sym.imp.printf
0x08048370    1      6 sym.imp.exit
0x080483bc    1  78628 entry0

And it uses unusual sigaction function. How to bypass such anti-debugging protection? And what to read about it?

Improve this question
2
  • 1
    sigaction is used to register an action when a signal is triggered, the crackme probably register a handler for SIGSEGV, the instruction at 0x8049094 might causes a SIGSEGV on purpose to trigger this handler. You need to find where's this handler. It should be the field sa_sigaction, and it will probably update the ucontext parameter. man7.org/linux/man-pages/man2/sigaction.2.html Can you share a link to the crackme?
    – wisk
    Commented Aug 25 at 4:37
  • 1
    If you could share the main function or binary, we’d have a chance to examine it as well. What makes you think the segmentation fault is being used as an anti-debugging technique? It’s also possible that the segmentation fault was caused by poor programming, especially since you mentioned not entering any input. It would’ve been great if you had at least shared the disassembler output of the entry0 function. What difference would it make if there were no segmentation fault? You’re not finding the flag in this situation anyway.
    – Kerim Can Kalıpcıoğlu
    Commented Nov 1 at 20:43

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.