Hot answers tagged

36

Here are a bunch: https://www.wechall.net/active_sites http://www.wechall.net/challs/ https://crackmes.one https://pwnable.xyz/ https://tuts4you.com/download.php?list.17 https://github.com/fdivrp/awesome-reversing/ https://github.com/michalmalik/linux-re-101 https://tuts4you.com/download.php https://github.com/RPISEC/MBE https://github.com/Maijin/...


14

A good way to quickly find if a function f() has an inverse or not, is trying to find two elements of the initial domain x and y such that x!=y and f(x)==f(y). If such couple of elements exist, you cannot distinguish them in the target domain of f and, thus, a reverse function cannot be built. Looking at your example: f(x) = x^(x>>11), we can split ...


10

https://dilsec.wordpress.com/2017/07/06/google-ctf-2017-pwnables-inst_prof-writeup/ (Google CTF Writeup) https://www.cs.ucsb.edu/~chris/teaching/cs290/projects/proj4.html (see Challenge 4 ) https://www.fireeye.com/blog/threat-research/2015/07/announcing_the_secon.html (FLARE) https://cedricvb.be/post/reverse-engineering-the-hitb-binary-100-ctf-challenge/ (...


10

First of all, the fact to turn a program into a bytecode that will be interpreted by a crafted VM which will be embedded into the software is a quite well-known technique of obfuscation. There have been numerous writings about it. If you want to find good pointers about it (and how to solve it in different ways), I would advise you to search for "VM-...


8

Perror already covered this particular case, but here are some general principles for inverting similar functions. Note: all of this assumes the integer is either unsigned, or it is signed using two's complement and using unsigned shifts. In Java, two's complement is guaranteed. In C/C++, it is not guaranteed, but it's almost always the case in practice, ...


8

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = 0x7fd7ee4f7578 rdx = 0x7ffd63b54428 r8 = 0x7fd7ee4f8be0 r9 = 0x7fd7ee4f8be0 r10 = 0x00000001 r11 = 0x00000000 r12 = 0x55bea3306ae0 r13 = 0x7ffd63b54410 r14 = ...


7

I wrote some articles (search for radare2) about using r2 for crackmes, and there is a talk section on the official website. Also you can find useful articles from the blog. Also, feel free to come ask questions on the irc channel.


6

If you have very little experience in binary RE I would suggest to start with preparing for a lot of unknown information that would be "thrown" on you, time and patience :-). Now to the subject. To do the work your are talking about, you'll need tools and you need to know them well: Olly - to do the dynamic analysis of the binary. The one you already have ...


5

Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.


5

I try to give a very superficial answer for your question because I am quite sure that there are other treatments for this problem. Mathematically, the function f(y) = y^(y >> 11) is invertible in the sense that the left-inversion, namely a function g so that y = g(f(y)) exists, because f is an injective function. However that does not mean we can ...


5

Those are C++ mangled names. Some tools like Ghidra will automatically demangle them for you. If you want to see what the function should be named try: c++filt _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc in your shell to see the demangled name.


4

I think this is what you are looking for: https://github.com/maijin/workshop2015 And of course just join the chat room on freenode #radare2 and ask questions.


4

You should take a look at crackmes.de, especially level 6, like this one, or this one.


4

Short, slightly snarky answer: yes, there must be a way to make a keygen. If there wasn't, the creators of the software themselves wouldn't be able to create keys to sell. Longer answer: If the software vendor wants the encryption to be non-identifiable for people who have reversed the decryption part, they need to use some assymetric key algorithm, where ...


4

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of things, but it doesn't have any known magic bytes at the beginning and doesn't appear to belong to any commonly known file type. Your best bet with getting ...


4

Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function. #include <Windows.h> typedef DWORD (__cdecl *_GetFlag)(); _GetFlag GetFlag; HMODULE hDll = NULL; NTSTATUS main(int argc, char **argv) { hDll = LoadLibrary("my_head_flew_away_patched.dll"); GetFlag = (...


4

The "good boy" is the thing that lets you know you were successful in your cracking/patching. The "bad boy" is the thing that lets you know you're unsuccessful. In a commercial app, a "good boy" would be akin to a message box saying, "Thank you for entering a valid license! You're now fully registered." Whereas the "bad boy" would be the message box that ...


4

I gave it a go. First I simplified your code a little bit. def the_process(stored, inp, size): global thstr idx = 0 idx = stored.index(inp[0]) if idx: the_process(stored[:idx], inp[1:], idx) if size - 1 != idx: the_process(stored[idx+1:],inp[idx+1:], size - idx - 1) thstr.append(inp[0]) Now it looks like by the ...


4

The cmp instruction does not multiply anything by two. Instead, the piece of code seen in your ollydbg screen shot is the implementation of the following line from the poor quality source code image you attached: if ((!key) || (key > (0x1337 * 2000))) First, in address 0x01051C09, key is compared to 0. If key equals 0 a jump to 0x01051C18 is taken. ...


3

Since it is a crackme, I don't want to spoiler the solution, although I try to give some hint, which may help you. The hash function may be MD5 using salt, modified IV or the hash function is used in a different way as you try. However, you neither have to reverse the hash function nor have to find out the exact algorithm. It is because, the crackme ...


3

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. However, Today I would recommend Telerik's JustDecompile though as it has built in de-obfuscation (de4dot) and has an option to replace a section with code which is ...


3

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=XaWtoCmOGpw#t=1m40s


3

We can define recursive functions in SMT language (e.g. with define-fun-rec), but some popular solvers (e.g. z3) currently cannot handle them yet (I do not know any can support); so it is not direct to encode loops in such a solver. But we can use a trick, that is to just unroll the loop (then it is still obliged to test several lengths of the password) by ...


3

In this particular case, repairing the header can be automated. Since the section header string table is present, the original value of e_shnum can be found by counting the number of strings in the table. Original: $ readelf -h hello ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: ...


3

The first thing with radare2 is to make sure that you're running the latest git version. To get help about commands in radare2, you can use the ? character. For help about configuration variables, you can use e?? (since e? would give you help about how to use them, not list them). Since there are many variables, you can filter them with the internal grep ...


3

I assume your friend did not utilize tricks like anti-debugging and packing the binary, as your first challenge. Assuming is not right for an answer, so you should provide more details next time :) How I would approach this: Go trough Lena's tutorials. Identify what is the application was written in. There are multiple tools for this, such as : PEID or ...


3

We collect useful links about using radare2 on our forum (jvoisin blog too :) )


3

The reason for your observation is an overflow in the sscanf call that is done in the function checking if the number is even or odd. While the check for your 9-character password succeeds the 10-character password produces an overflow and the check fails. To verify, compile and run the following C code: #include <stdio.h> #include <stdlib.h> ...


3

If you follow the flow, you will see that the result of the first "lea ebx, []" is replaced by the result of the "lea ebx, []", with no intervening use of ebx. While they can serve a meaningful purpose (consider position-independent code), that's not their use here. These are garbage instructions that exist only to confuse someone looking at the ...


Only top voted, non community-wiki answers of a minimum length are eligible