I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that:
(gdb) info files
...
Entry point: 0xcf8
...
So I set a breakpoint at the entry point
and run the program:
(gdb) break *0xcf8
Breakpoint 1 at 0xcf8
(gdb) run
Starting program: /home/tathanhdinh/CTFs/hackercalc
Error in re-setting breakpoint 1: Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8
Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8
That seems this breakpoint does not work. I do not understand why it says Cannot access memory at address 0xcf8
but I guess that there was some code which runs before has made some interference (so the program cannot reach this entry point), this code must be the elf interpreter
of the program.
Next, I look into segments of the programm, all seems to be normal (except that it says the program is a shared object file
, but I think this is not important):
readelf --segments hackercalc
Elf file type is DYN (Shared object file)
Entry point 0xcf8
There are 8 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x00000034 0x00000034 0x00100 0x00100 R E 0x4
INTERP 0x000154 0x00000154 0x00000154 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x00000000 0x00000000 0x16b4a 0x16b4a R E 0x1000
LOAD 0x016eac 0x00017eac 0x00017eac 0x001e4 0x001ec RW 0x1000
Now, I try to get again information about this process:
(gdb) info files
Symbols from "/home/tathanhdinh/CTFs/hackercalc".
Native process:
Using the running image of child process 10545.
While running this, GDB does not access memory from...
Local exec file:
`/home/tathanhdinh/CTFs/hackercalc', file type elf32-i386.
Entry point: 0x56555cf8
And I am totally lost here, why the elf interpreter
(which is ld-linux.so.2
) can create a new process in this case?
I try another approach by loading the challenge into IDA, set a breakpoint at the entry point, then run but IDA simply hangs up!!!
So my question is: how can this happen? Am I totally wrong about the code executed before the entry point? Does the challenge use some special tricks to bypass debugging?