Digital Stronghold - Software Engineering Blog

Language C
Linux x86/ELF

Difficulty: 1 - Very easy, for newbies
Platform: Unix/Linux, etc.
Language: C/C++

[Solving the Crackme]

As usual, we have to run the file first.

joset@kee:~/src/crackmes/mycrk$ ./mycrk
Type cd-key: eve
wrong!
joset@kee:~/src/crackmes/mycrk$

From this point we already know what the file needs, a correct key. I immediately disassembled the file without even bothering about its characteristics.

joset@kee:~/src/crackmes/mycrk$ objdump -d mycrk > temp.txt
joset@kee:~/src/crackmes/mycrk$ less temp.txt

The first trick, is to look for the disassembly of the main function. Here’s a portion of it.

...
 80483d4:       c7 45 fc 67 1e 01 00    movl   $0x11e67,0xfffffffc(%ebp)
 80483db:       c7 45 f8 70 12 5b 00    movl   $0x5b1270,0xfffffff8(%ebp)
 80483e2:       c7 45 f0 06 00 00 00    movl   $0x6,0xfffffff0(%ebp)
 80483e9:       83 ec 0c                sub    $0xc,%esp
 80483ec:       68 14 85 04 08          push   $0x8048514
 80483f1:       e8 ee fe ff ff          call   80482e4 <printf @plt>
 80483f6:       83 c4 10                add    $0x10,%esp
 80483f9:       83 ec 08                sub    $0x8,%esp
 80483fc:       8d 45 f4                lea    0xfffffff4(%ebp),%eax
 80483ff:       50                      push   %eax
 8048400:       68 22 85 04 08          push   $0x8048522
 8048405:       e8 ba fe ff ff          call   80482c4 <scanf @plt>
 804840a:       83 c4 10                add    $0x10,%esp
 804840d:       8b 45 f8                mov    0xfffffff8(%ebp),%eax
 8048410:       3b 45 f4                cmp    0xfffffff4(%ebp),%eax
 8048413:       75 1d                   jne    8048432 <main +0x6e>
 8048415:       8b 55 f0                mov    0xfffffff0(%ebp),%edx
 8048418:       8d 45 fc                lea    0xfffffffc(%ebp),%eax
 804841b:       31 10                   xor    %edx,(%eax)
 804841d:       83 ec 08                sub    $0x8,%esp
…

I am not going to provide a detailed information about this. Let’s observe the line there with a cmp, since lines with cmps usually attract crackers’ eyes at a first glance. It is very obvious that a value is being compared with the content of the eax register and is obtained through a buffered input because the line is preceded with a call 80482c4 <scanf @plt>. How do we get the value of the eax register? Getting the idea? Of course, we will use gdb by setting a breakpoint where the line resides and displaying the value being held by the eax register.

joset@kee:~/src/crackmes/mycrk$ gdb ./mycrk
...
(gdb) b *0x8048410
Breakpoint 1 at 0x8048410
(gdb) r
Starting program: /home/joset/src/crackmes/mycrk/mycrk
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
Type cd-key: eve
	
Breakpoint 1, 0x08048410 in main ()
(gdb) print $eax
$1 = 5968496
(gdb)

Looking back, we can see that it would jump to 8048432 <main +0x6e> if the values didn’t satisfy each other. Let’s see what it does from there.

...
 8048432:       83 ec 0c                sub    $0xc,%esp
 8048435:       68 29 85 04 08          push   $0x8048529
 804843a:       e8 a5 fe ff ff          call   80482e4 <printf @plt>
 804843f:       83 c4 10                add    $0x10,%esp
 8048442:       b8 00 00 00 00          mov    $0x0,%eax
 8048447:       c9                      leave
 8048448:       c3                      ret
...

There’s the presence of a call 80482e4 <printf @plt>. We can come up with an assumption that it is the notification being printed if an invalid key is entered. Therefore the key is the value being held by the eax register awhile ago. Let’s try it.

joset@kee:~/src/crackmes/mycrk$ ./mycrk
Type cd-key: 5968496
73313
joset@kee:~/src/crackmes/mycrk$

Done.