Introduction :
Oyez, Oyez braves gens !
Voici mon premier tutoriel sur le "cracking" avec
J'ai fais se tutoriel dans un premier temps pour m'enrichir moi-même puis heuu pour vous !
Voilà pourquoi j'ai décidé de dev mon propre crackme, j'étais en total terre inconnue (ma première expérience linux par la même occaz) maintenant un peu moins bref passons et commençons.
HS: J'ai choisi d'installé Ubuntu comme système d'exploitation pour ça facilité d'utilisation.
Enfin installé... vous pouvez partitionné votre disque ou bien faire une machine virtuelle.
Programmons notre crack-me :
/*
#------------------------------------------------------------------------#
# Description : Petit logiciel qui vous demande le bon mot de passe. #
# OS : Linux #
# Requires : gcc #
# Compiling : gcc -Wall -o crackme crackme.c #
# Version : 0.1.0 #
# Author : Xylitol #
# Web site : http://xylitol.tapz.eu #
# Licence : GPL #
# Remerciement : Tux-planet, debjit625 #
#------------------------------------------------------------------------#
*/
#include "stdio.h"
#include "stdlib.h"
#include "string.h"
#define MAXSIZE 100
int main()
{
char code[MAXSIZE]= "";
printf("Give us the good code... or DIE !\nPassword : ");
scanf("%s",&code);
if (strcmp(code,"35C4P3\0")==0)
{
printf("lol faggot, That not the good place\n");
printf("but you escaped us ><\n");
exit(1);
}
if (strcmp(code,"XylitolLikeSeX\0")==0)
{
printf("Access Granted \n");
printf("We keep you alive, have a nice day \n");
}
else
{
printf("Access Denied \n");
printf("All hope is gone, are you ready to die ? \n");
}
return 0;
}
#------------------------------------------------------------------------#
# Description : Petit logiciel qui vous demande le bon mot de passe. #
# OS : Linux #
# Requires : gcc #
# Compiling : gcc -Wall -o crackme crackme.c #
# Version : 0.1.0 #
# Author : Xylitol
# Web site : http://xylitol.tapz.eu #
# Licence : GPL #
# Remerciement : Tux-planet, debjit625 #
#------------------------------------------------------------------------#
*/
#include "stdio.h"
#include "stdlib.h"
#include "string.h"
#define MAXSIZE 100
int main()
{
char code[MAXSIZE]= "";
printf("Give us the good code... or DIE !\nPassword : ");
scanf("%s",&code);
if (strcmp(code,"35C4P3\0")==0)
{
printf("lol faggot, That not the good place\n");
printf("but you escaped us ><\n");
exit(1);
}
if (strcmp(code,"XylitolLikeSeX\0")==0)
{
printf("Access Granted \n");
printf("We keep you alive, have a nice day \n");
}
else
{
printf("Access Denied \n");
printf("All hope is gone, are you ready to die ? \n");
}
return 0;
}
Le code et assez simple à comprendre, ici il y a trois mots de passe possible, j'aurais pu en faire un seul mais bon... :)
Donc voilà compilé votre application avec gcc
Maintenant il nous reste plus qu'à le débogué, un p'ti screen pour le fun
On va commencé par quelque chose de bête et méchant.
Le patching :
Ouvrez un terminal et tapez: gdb crackme (ouvre gdb et load le target)
puis ensuite: disas main (montre le code asm de la fonction main)
xylitol@XyliBox:~/Bureau$ gdb crackme
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) disas main
Dump of assembler code for function main:
0x080484e4: lea 0x4(%esp),%ecx
0x080484e8: and $0xfffffff0,%esp
0x080484eb: pushl -0x4(%ecx)
0x080484ee: push %ebp
0x080484ef: mov %esp,%ebp
0x080484f1: push %edi
0x080484f2: push %ecx
0x080484f3: sub $0x90,%esp
0x080484f9: mov %gs:0x14,%eax
0x080484ff: mov %eax,-0xc(%ebp)
0x08048502: xor %eax,%eax
0x08048504: movl $0x0,-0x70(%ebp)
0x0804850b: lea -0x6c(%ebp),%edx
0x0804850e: mov %edx,-0x7c(%ebp)
0x08048511: movl $0x0,-0x80(%ebp)
0x08048518: mov $0x60,%eax
0x0804851d: cmp $0x4,%eax
0x08048520: jb 0x804853a
0x08048522: movl $0x18,-0x84(%ebp)
---Type to continue, or q to quit---r
0x0804852c: mov -0x7c(%ebp),%edi
0x0804852f: mov -0x84(%ebp),%ecx
0x08048535: mov -0x80(%ebp),%eax
0x08048538: rep stos %eax,%es:(%edi)
0x0804853a: movl $0x80486c0,(%esp)
0x08048541: call 0x80483e0
0x08048546: lea -0x70(%ebp),%eax
0x08048549: mov %eax,0x4(%esp)
0x0804854d: movl $0x80486ee,(%esp)
0x08048554: call 0x80483d0
0x08048559: movl $0x80486f1,0x4(%esp)
0x08048561: lea -0x70(%ebp),%eax
0x08048564: mov %eax,(%esp)
0x08048567: call 0x8048410
0x0804856c: test %eax,%eax
0x0804856e: jne 0x8048594
0x08048570: movl $0x80486fc,(%esp)
0x08048577: call 0x8048400
0x0804857c: movl $0x8048720,(%esp)
0x08048583: call 0x8048400
---Type to continue, or q to quit---r
0x08048588: movl $0x1,(%esp)
0x0804858f: call 0x8048420
0x08048594: movl $0x8048736,0x4(%esp)
0x0804859c: lea -0x70(%ebp),%eax
0x0804859f: mov %eax,(%esp)
0x080485a2: call 0x8048410
0x080485a7: test %eax,%eax
0x080485a9: jne 0x80485c5
0x080485ab: movl $0x8048746,(%esp)
0x080485b2: call 0x8048400
0x080485b7: movl $0x8048758,(%esp)
0x080485be: call 0x8048400
0x080485c3: jmp 0x80485dd
0x080485c5: movl $0x804877c,(%esp)
0x080485cc: call 0x8048400
0x080485d1: movl $0x804878c,(%esp)
0x080485d8: call 0x8048400
0x080485dd: mov $0x0,%eax
0x080485e2: mov -0xc(%ebp),%edx
0x080485e5: xor %gs:0x14,%edx
---Type to continue, or q to quit---r
0x080485ec: e 0x80485f3
0x080485ee: call 0x80483f0 <__stack_chk_fail@plt>
0x080485f3: add $0x90,%esp
0x080485f9: pop %ecx
0x080485fa: pop %edi
0x080485fb: pop %ebp
0x080485fc: lea -0x4(%ecx),%esp
0x080485ff: ret
End of assembler dump.
(gdb)
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) disas main
Dump of assembler code for function main:
0x080484e4
0x080484e8
0x080484eb
0x080484ee
0x080484ef
0x080484f1
0x080484f2
0x080484f3
0x080484f9
0x080484ff
0x08048502
0x08048504
0x0804850b
0x0804850e
0x08048511
0x08048518
0x0804851d
0x08048520
0x08048522
---Type
0x0804852c
0x0804852f
0x08048535
0x08048538
0x0804853a
0x08048541
0x08048546
0x08048549
0x0804854d
0x08048554
0x08048559
0x08048561
0x08048564
0x08048567
0x0804856c
0x0804856e
0x08048570
0x08048577
0x0804857c
0x08048583
---Type
0x08048588
0x0804858f
0x08048594
0x0804859c
0x0804859f
0x080485a2
0x080485a7
0x080485a9
0x080485ab
0x080485b2
0x080485b7
0x080485be
0x080485c3
0x080485c5
0x080485cc
0x080485d1
0x080485d8
0x080485dd
0x080485e2
0x080485e5
---Type
0x080485ec
0x080485ee
0x080485f3
0x080485f9
0x080485fa
0x080485fb
0x080485fc
0x080485ff
End of assembler dump.
(gdb)
Assez facile en fin de compte claire ça me change d'ollydbg, mais bon...
En mode RTFM :
These routines compare strings using a lexicographical ordering. On entry to strcmp or stricmp, es:di points at the first string and dx:si points at the second string. Strcmp compares the first string to the second and returns the result of the comparison in the flags register.
Source: http://www.arl.wustl.edu/~lockwood/class/cs306/books/artofasm/Chapter_15/CH15-5.html#HEADING5-153
The puts (put a string) routine prints the zero terminated string at which es:di points. Note that puts does not automatically output a newline after printing the string.
Source: http://www.arl.wustl.edu/~lockwood/class/cs306/books/artofasm/Chapter_7/CH07-1.html#HEADING1-91
Printf, like its "C" namesake, provides formatted output capabilities for the Standard Library package.
[...]
The format string is comparable to the one provided in the "C" programming language. For most characters, printf simply prints the characters in the format string up to the terminating zero byte. The two exceptions are characters prefixed by a backslash ("\") and characters prefixed by a percent sign ("%"). Like C's printf, the Standard Library's printf uses the backslash as an escape character and the percent sign as a lead-in to a format string.
Source: http://www.arl.wustl.edu/~lockwood/class/cs306/books/artofasm/Chapter_7/CH07-1.html#HEADING1-91
scanf is a function that reads data with specified format from a given string stream source, originated from C programming language, and is present in many other programming languages.
Source: http://en.wikipedia.org/wiki/Scanf
J'ai pas vraiment besoin d'RTFM mais c'était juste pour le fun.
On notera par la suite quelques passages susceptibles d'être intéressants:
0x08048567 : call 0x8048410 // cmp, Comparaison
0x0804856c: test %eax,%eax // Test si EAX = zero
0x0804856e: jne 0x8048594 // Jump if Not Equal, ce qui signifie saute si non-égalité (ZF=0)
[...]
0x080485a2: call 0x8048410 // cmp, Comparaison
0x080485a7: test %eax,%eax // Test si EAX = zero
0x080485a9: jne 0x80485c5 // Jump if Not Equal, ce qui signifie saute si non-égalité (ZF=0)
0x0804856c
0x0804856e
[...]
0x080485a2
0x080485a7
0x080485a9
Bon on sais comment le crack-me marche, que diriez vous de mettre un point d'arrêt sur strcmp ?
Pour faire cela: b* main+131 ou bien break* main+131
Note: vous pouvez tapé info break pour connaitre tous vos points d'arrêt.
exécuté le, tapez F9... ah heu merde! tapez: run
(gdb) run
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password :
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password :
Kick, Punch, Turn and chop the door
Or, i will fail to the floor ♪♫♪♪♫
Bon so, entrer quelque chose et validé !
Breakpoint 1, 0x08048567 in main ()
Current language: auto; currently asm
(gdb)
Current language: auto; currently asm
(gdb)
On a breaké sur la comparaison comme prévu
Petite analyse après débug: si on a ZF = 0 c'est mort
So we need to bypass le JNE, on va l'sauté et passé à l'instruction d'après:
0x08048570 : movl $0x80486fc,(%esp)
Pour cela: jump* main+140
(gdb) jump* main+140
Continuing at 0x8048570.
lol faggot, That not the good place
but you escaped us ><
Program exited with code 01.
(gdb)
Continuing at 0x8048570.
lol faggot, That not the good place
but you escaped us ><
Program exited with code 01.
(gdb)
Et bien voilà on a "echappé à la mort"
Faite pareille sur l'autre cmp c'est la même chose.
(gdb) break* main+190
Breakpoint 2 at 0x80485a2
(gdb) r
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password : 123456789
Breakpoint 1, 0x08048567 in main ()
(gdb) jump* main+199
Continuing at 0x80485ab.
Access Granted
We keep you alive, have a nice day
Program exited normally.
(gdb)
Breakpoint 2 at 0x80485a2
(gdb) r
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password : 123456789
Breakpoint 1, 0x08048567 in main ()
(gdb) jump* main+199
Continuing at 0x80485ab.
Access Granted
We keep you alive, have a nice day
Program exited normally.
(gdb)
Ouai super mais c'était quoi le bon mot de passe ?
Oon va voir ça tout de suite.
Serial sniff :
Quitté gdb avec quit, puis tapé strings crackme
(gdb) quit
xylitol@XyliBox:~/Bureau$strings crackme
/lib/ld-linux.so.2
__gmon_start__
libc.so.6
_IO_stdin_used
exit
puts
__stack_chk_fail
printf
scanf
strcmp
__libc_start_main
GLIBC_2.4
GLIBC_2.0
PTRh
[^_]
Give us the good code... or DIE !
Password :
35C4P3
lol faggot, That not the good place
but you escaped us ><
XylitolLikeSeX
Access Granted
We keep you alive, have a nice day
Access Denied
All hope is gone, are you ready to die ?
xylitol@XyliBox:~/Bureau$
xylitol@XyliBox:~/Bureau$strings crackme
/lib/ld-linux.so.2
__gmon_start__
libc.so.6
_IO_stdin_used
exit
puts
__stack_chk_fail
printf
scanf
strcmp
__libc_start_main
GLIBC_2.4
GLIBC_2.0
PTRh
[^_]
Give us the good code... or DIE !
Password :
35C4P3
lol faggot, That not the good place
but you escaped us ><
XylitolLikeSeX
Access Granted
We keep you alive, have a nice day
Access Denied
All hope is gone, are you ready to die ?
xylitol@XyliBox:~/Bureau$
C'est vraiment une méthode de merde mais ça marche (dans ce contexte) La il suffit de testé les strings susceptibles d'être des serials potentiels.
Bon on va voir autrement.
Avec gdb une fois que vous avez breaké sur strcmp tapé x/2x $esp
Cela va examiner la mémoire « x » + format (« o » = octal, « x » = hexa, « u » = décimal non signé,
« t » = binaire, le "2" c'est le nombre d'arguments a sortire).
(gdb) x/2x $esp
0xbfbc2030: 0xbfbc2058 0x08048736
0xbfbc2030: 0xbfbc2058 0x08048736
Maintenant tapé x/s 0xbfbc2058 pour affiché l'argument du pointeur. (s = strings)
(gdb) x/s 0xbfbc2058
0xbfbc2058: "1337"
0xbfbc2058: "1337"
Même principe pour le second:
(gdb) x/s 0x08048736
0x8048736: "XylitolLikeSeX"
0x8048736: "XylitolLikeSeX"
Le "1337" c'est un faux serial que j'ai entré et le "XylitolLikeSeX" je vous fais pas un dessin quoi.
(gdb) break* main+190
Breakpoint 1 at 0x80485a2
(gdb) r
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password : 1337
Breakpoint 1, 0x080485a2 in main ()
Current language: auto; currently asm
(gdb) x/2x $esp
0xbfbc2030: 0xbfbc2058 0x08048736
(gdb) x/s 0xbfbc2058
0xbfbc2058: "1337"
(gdb) x/s 0x08048736
0x8048736: "XylitolLikeSeX"
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password : XylitolLikeSeX
Breakpoint 1, 0x080485a2 in main ()
(gdb) n
Single stepping until exit from function main,
which has no line number information.
Access Granted
We keep you alive, have a nice day
Breakpoint 1 at 0x80485a2
(gdb) r
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password : 1337
Breakpoint 1, 0x080485a2 in main ()
Current language: auto; currently asm
(gdb) x/2x $esp
0xbfbc2030: 0xbfbc2058 0x08048736
(gdb) x/s 0xbfbc2058
0xbfbc2058: "1337"
(gdb) x/s 0x08048736
0x8048736: "XylitolLikeSeX"
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/xylitol/Bureau/crackme
Give us the good code... or DIE !
Password : XylitolLikeSeX
Breakpoint 1, 0x080485a2 in main ()
(gdb) n
Single stepping until exit from function main,
which has no line number information.
Access Granted
We keep you alive, have a nice day
Faire une version cracké:
Déjà, installé hexedit si vous ne le possédez pas.
xylitol@XyliBox:~/Bureau$ sudo apt-get install hexedit
[sudo] password for xylitol: ************
Lecture des listes de paquets... Fait
Construction de l'arbre des dépendances
Lecture des informations d'état... Fait
Les NOUVEAUX paquets suivants seront installés*:
hexedit
0 mis à jour, 1 nouvellement installés, 0 à enlever et 0 non mis à jour.
Il est nécessaire de prendre 28,4ko dans les archives.
Après cette opération, 115ko d'espace disque supplémentaires seront utilisés.
Réception de*: 1 http://fr.archive.ubuntu.com jaunty/universe hexedit 1.2.12-3 [28,4kB]
28,4ko réceptionnés en 0s (74,1ko/s)
Sélection du paquet hexedit précédemment désélectionné.
(Lecture de la base de données... 103400 fichiers et répertoires déjà installés.)
Dépaquetage de hexedit (à partir de .../hexedit_1.2.12-3_i386.deb) ...
Traitement des actions différées («*triggers*») pour « man-db »...
Paramétrage de hexedit (1.2.12-3) ...
xylitol@XyliBox:~/Bureau$
[sudo] password for xylitol: ************
Lecture des listes de paquets... Fait
Construction de l'arbre des dépendances
Lecture des informations d'état... Fait
Les NOUVEAUX paquets suivants seront installés*:
hexedit
0 mis à jour, 1 nouvellement installés, 0 à enlever et 0 non mis à jour.
Il est nécessaire de prendre 28,4ko dans les archives.
Après cette opération, 115ko d'espace disque supplémentaires seront utilisés.
Réception de*: 1 http://fr.archive.ubuntu.com jaunty/universe hexedit 1.2.12-3 [28,4kB]
28,4ko réceptionnés en 0s (74,1ko/s)
Sélection du paquet hexedit précédemment désélectionné.
(Lecture de la base de données... 103400 fichiers et répertoires déjà installés.)
Dépaquetage de hexedit (à partir de .../hexedit_1.2.12-3_i386.deb) ...
Traitement des actions différées («*triggers*») pour « man-db »...
Paramétrage de hexedit (1.2.12-3) ...
xylitol@XyliBox:~/Bureau$
Done.
Note: Maintenant il y a "aptitude"
xylitol@XyliBox:~/Bureau$ hexedit
*Hexedit s'ouvre*
File name: crackme
Laissé hexedit quelque par et lancé objdump
xylitol@XyliBox:~/Bureau$ objdump -d crackme
crackme: file format elf32-i386
Disassembly of section .init:
08048370 <_init>:
8048370: 55 push %ebp
8048371: 89 e5 mov %esp,%ebp
8048373: 53 push %ebx
8048374: 83 ec 04 sub $0x4,%esp
8048377: e8 00 00 00 00 call 804837c <_init+0xc>
804837c: 5b pop %ebx
804837d: 81 c3 78 1c 00 00 add $0x1c78,%ebx
8048383: 8b 93 fc ff ff ff mov -0x4(%ebx),%edx
8048389: 85 d2 test %edx,%edx
804838b: 74 05 je 8048392 <_init+0x22>
804838d: e8 1e 00 00 00 call 80483b0 <__gmon_start__@plt>
8048392: e8 29 01 00 00 call 80484c0
8048397: e8 d4 02 00 00 call 8048670 <__do_global_ctors_aux>
804839c: 58 pop %eax
804839d: 5b pop %ebx
804839e: c9 leave
804839f: c3 ret
Disassembly of section .plt:
080483a0 <__gmon_start__@plt-0x10>:
80483a0: ff 35 f8 9f 04 08 pushl 0x8049ff8
80483a6: ff 25 fc 9f 04 08 jmp *0x8049ffc
80483ac: 00 00 add %al,(%eax)
...
080483b0 <__gmon_start__@plt>:
80483b0: ff 25 00 a0 04 08 jmp *0x804a000
80483b6: 68 00 00 00 00 push $0x0
80483bb: e9 e0 ff ff ff jmp 80483a0 <_init+0x30>
080483c0 <__libc_start_main@plt>:
80483c0: ff 25 04 a0 04 08 jmp *0x804a004
80483c6: 68 08 00 00 00 push $0x8
80483cb: e9 d0 ff ff ff jmp 80483a0 <_init+0x30>
080483d0:
80483d0: ff 25 08 a0 04 08 jmp *0x804a008
80483d6: 68 10 00 00 00 push $0x10
80483db: e9 c0 ff ff ff jmp 80483a0 <_init+0x30>
080483e0:
80483e0: ff 25 0c a0 04 08 jmp *0x804a00c
80483e6: 68 18 00 00 00 push $0x18
80483eb: e9 b0 ff ff ff jmp 80483a0 <_init+0x30>
080483f0 <__stack_chk_fail@plt>:
80483f0: ff 25 10 a0 04 08 jmp *0x804a010
80483f6: 68 20 00 00 00 push $0x20
80483fb: e9 a0 ff ff ff jmp 80483a0 <_init+0x30>
08048400:
8048400: ff 25 14 a0 04 08 jmp *0x804a014
8048406: 68 28 00 00 00 push $0x28
804840b: e9 90 ff ff ff jmp 80483a0 <_init+0x30>
08048410:
8048410: ff 25 18 a0 04 08 jmp *0x804a018
8048416: 68 30 00 00 00 push $0x30
804841b: e9 80 ff ff ff jmp 80483a0 <_init+0x30>
08048420:
8048420: ff 25 1c a0 04 08 jmp *0x804a01c
8048426: 68 38 00 00 00 push $0x38
804842b: e9 70 ff ff ff jmp 80483a0 <_init+0x30>
Disassembly of section .text:
08048430 <_start>:
8048430: 31 ed xor %ebp,%ebp
8048432: 5e pop %esi
8048433: 89 e1 mov %esp,%ecx
8048435: 83 e4 f0 and $0xfffffff0,%esp
8048438: 50 push %eax
8048439: 54 push %esp
804843a: 52 push %edx
804843b: 68 00 86 04 08 push $0x8048600
8048440: 68 10 86 04 08 push $0x8048610
8048445: 51 push %ecx
8048446: 56 push %esi
8048447: 68 e4 84 04 08 push $0x80484e4
804844c: e8 6f ff ff ff call 80483c0 <__libc_start_main@plt>
8048451: f4 hlt
8048452: 90 nop
8048453: 90 nop
8048454: 90 nop
8048455: 90 nop
8048456: 90 nop
8048457: 90 nop
8048458: 90 nop
8048459: 90 nop
804845a: 90 nop
804845b: 90 nop
804845c: 90 nop
804845d: 90 nop
804845e: 90 nop
804845f: 90 nop
08048460 <__do_global_dtors_aux>:
8048460: 55 push %ebp
8048461: 89 e5 mov %esp,%ebp
8048463: 53 push %ebx
8048464: 83 ec 04 sub $0x4,%esp
8048467: 80 3d 28 a0 04 08 00 cmpb $0x0,0x804a028
804846e: 75 40 jne 80484b0 <__do_global_dtors_aux+0x50>
8048470: 8b 15 2c a0 04 08 mov 0x804a02c,%edx
8048476: b8 18 9f 04 08 mov $0x8049f18,%eax
804847b: 2d 14 9f 04 08 sub $0x8049f14,%eax
8048480: c1 f8 02 sar $0x2,%eax
8048483: 8d 58 ff lea -0x1(%eax),%ebx
8048486: 39 da cmp %ebx,%edx
8048488: 73 1f jae 80484a9 <__do_global_dtors_aux+0x49>
804848a: 8d b6 00 00 00 00 lea 0x0(%esi),%esi
8048490: 8d 42 01 lea 0x1(%edx),%eax
8048493: a3 2c a0 04 08 mov %eax,0x804a02c
8048498: ff 14 85 14 9f 04 08 call *0x8049f14(,%eax,4)
804849f: 8b 15 2c a0 04 08 mov 0x804a02c,%edx
80484a5: 39 da cmp %ebx,%edx
80484a7: 72 e7 jb 8048490 <__do_global_dtors_aux+0x30>
80484a9: c6 05 28 a0 04 08 01 movb $0x1,0x804a028
80484b0: 83 c4 04 add $0x4,%esp
80484b3: 5b pop %ebx
80484b4: 5d pop %ebp
80484b5: c3 ret
80484b6: 8d 76 00 lea 0x0(%esi),%esi
80484b9: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi
080484c0:
80484c0: 55 push %ebp
80484c1: 89 e5 mov %esp,%ebp
80484c3: 83 ec 08 sub $0x8,%esp
80484c6: a1 1c 9f 04 08 mov 0x8049f1c,%eax
80484cb: 85 c0 test %eax,%eax
80484cd: 74 12 je 80484e1
80484cf: b8 00 00 00 00 mov $0x0,%eax
80484d4: 85 c0 test %eax,%eax
80484d6: 74 09 je 80484e1
80484d8: c7 04 24 1c 9f 04 08 movl $0x8049f1c,(%esp)
80484df: ff d0 call *%eax
80484e1: c9 leave
80484e2: c3 ret
80484e3: 90 nop
080484e4:
80484e4: 8d 4c 24 04 lea 0x4(%esp),%ecx
80484e8: 83 e4 f0 and $0xfffffff0,%esp
80484eb: ff 71 fc pushl -0x4(%ecx)
80484ee: 55 push %ebp
80484ef: 89 e5 mov %esp,%ebp
80484f1: 57 push %edi
80484f2: 51 push %ecx
80484f3: 81 ec 90 00 00 00 sub $0x90,%esp
80484f9: 65 a1 14 00 00 00 mov %gs:0x14,%eax
80484ff: 89 45 f4 mov %eax,-0xc(%ebp)
8048502: 31 c0 xor %eax,%eax
8048504: c7 45 90 00 00 00 00 movl $0x0,-0x70(%ebp)
804850b: 8d 55 94 lea -0x6c(%ebp),%edx
804850e: 89 55 84 mov %edx,-0x7c(%ebp)
8048511: c7 45 80 00 00 00 00 movl $0x0,-0x80(%ebp)
8048518: b8 60 00 00 00 mov $0x60,%eax
804851d: 83 f8 04 cmp $0x4,%eax
8048520: 72 18 jb 804853a
8048522: c7 85 7c ff ff ff 18 movl $0x18,-0x84(%ebp)
8048529: 00 00 00
804852c: 8b 7d 84 mov -0x7c(%ebp),%edi
804852f: 8b 8d 7c ff ff ff mov -0x84(%ebp),%ecx
8048535: 8b 45 80 mov -0x80(%ebp),%eax
8048538: f3 ab rep stos %eax,%es:(%edi)
804853a: c7 04 24 c0 86 04 08 movl $0x80486c0,(%esp)
8048541: e8 9a fe ff ff call 80483e0
8048546: 8d 45 90 lea -0x70(%ebp),%eax
8048549: 89 44 24 04 mov %eax,0x4(%esp)
804854d: c7 04 24 ee 86 04 08 movl $0x80486ee,(%esp)
8048554: e8 77 fe ff ff call 80483d0
8048559: c7 44 24 04 f1 86 04 movl $0x80486f1,0x4(%esp)
8048560: 08
8048561: 8d 45 90 lea -0x70(%ebp),%eax
8048564: 89 04 24 mov %eax,(%esp)
8048567: e8 a4 fe ff ff call 8048410
804856c: 85 c0 test %eax,%eax
804856e: 75 24 jne 8048594
8048570: c7 04 24 fc 86 04 08 movl $0x80486fc,(%esp)
8048577: e8 84 fe ff ff call 8048400
804857c: c7 04 24 20 87 04 08 movl $0x8048720,(%esp)
8048583: e8 78 fe ff ff call 8048400
8048588: c7 04 24 01 00 00 00 movl $0x1,(%esp)
804858f: e8 8c fe ff ff call 8048420
8048594: c7 44 24 04 36 87 04 movl $0x8048736,0x4(%esp)
804859b: 08
804859c: 8d 45 90 lea -0x70(%ebp),%eax
804859f: 89 04 24 mov %eax,(%esp)
80485a2: e8 69 fe ff ff call 8048410
80485a7: 85 c0 test %eax,%eax
80485a9: 75 1a jne 80485c5
80485ab: c7 04 24 46 87 04 08 movl $0x8048746,(%esp)
80485b2: e8 49 fe ff ff call 8048400
80485b7: c7 04 24 58 87 04 08 movl $0x8048758,(%esp)
80485be: e8 3d fe ff ff call 8048400
80485c3: eb 18 jmp 80485dd
80485c5: c7 04 24 7c 87 04 08 movl $0x804877c,(%esp)
80485cc: e8 2f fe ff ff call 8048400
80485d1: c7 04 24 8c 87 04 08 movl $0x804878c,(%esp)
80485d8: e8 23 fe ff ff call 8048400
80485dd: b8 00 00 00 00 mov $0x0,%eax
80485e2: 8b 55 f4 mov -0xc(%ebp),%edx
80485e5: 65 33 15 14 00 00 00 xor %gs:0x14,%edx
80485ec: 74 05 je 80485f3
80485ee: e8 fd fd ff ff call 80483f0 <__stack_chk_fail@plt>
80485f3: 81 c4 90 00 00 00 add $0x90,%esp
80485f9: 59 pop %ecx
80485fa: 5f pop %edi
80485fb: 5d pop %ebp
80485fc: 8d 61 fc lea -0x4(%ecx),%esp
80485ff: c3 ret
08048600 <__libc_csu_fini>:
8048600: 55 push %ebp
8048601: 89 e5 mov %esp,%ebp
8048603: 5d pop %ebp
8048604: c3 ret
8048605: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi
8048609: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi
08048610 <__libc_csu_init>:
8048610: 55 push %ebp
8048611: 89 e5 mov %esp,%ebp
8048613: 57 push %edi
8048614: 56 push %esi
8048615: 53 push %ebx
8048616: e8 4f 00 00 00 call 804866a <__i686.get_pc_thunk.bx>
804861b: 81 c3 d9 19 00 00 add $0x19d9,%ebx
8048621: 83 ec 0c sub $0xc,%esp
8048624: e8 47 fd ff ff call 8048370 <_init>
8048629: 8d bb 18 ff ff ff lea -0xe8(%ebx),%edi
804862f: 8d 83 18 ff ff ff lea -0xe8(%ebx),%eax
8048635: 29 c7 sub %eax,%edi
8048637: c1 ff 02 sar $0x2,%edi
804863a: 85 ff test %edi,%edi
804863c: 74 24 je 8048662 <__libc_csu_init+0x52>
804863e: 31 f6 xor %esi,%esi
8048640: 8b 45 10 mov 0x10(%ebp),%eax
8048643: 89 44 24 08 mov %eax,0x8(%esp)
8048647: 8b 45 0c mov 0xc(%ebp),%eax
804864a: 89 44 24 04 mov %eax,0x4(%esp)
804864e: 8b 45 08 mov 0x8(%ebp),%eax
8048651: 89 04 24 mov %eax,(%esp)
8048654: ff 94 b3 18 ff ff ff call *-0xe8(%ebx,%esi,4)
804865b: 83 c6 01 add $0x1,%esi
804865e: 39 fe cmp %edi,%esi
8048660: 72 de jb 8048640 <__libc_csu_init+0x30>
8048662: 83 c4 0c add $0xc,%esp
8048665: 5b pop %ebx
8048666: 5e pop %esi
8048667: 5f pop %edi
8048668: 5d pop %ebp
8048669: c3 ret
0804866a <__i686.get_pc_thunk.bx>:
804866a: 8b 1c 24 mov (%esp),%ebx
804866d: c3 ret
804866e: 90 nop
804866f: 90 nop
08048670 <__do_global_ctors_aux>:
8048670: 55 push %ebp
8048671: 89 e5 mov %esp,%ebp
8048673: 53 push %ebx
8048674: 83 ec 04 sub $0x4,%esp
8048677: a1 0c 9f 04 08 mov 0x8049f0c,%eax
804867c: 83 f8 ff cmp $0xffffffff,%eax
804867f: 74 13 je 8048694 <__do_global_ctors_aux+0x24>
8048681: bb 0c 9f 04 08 mov $0x8049f0c,%ebx
8048686: 66 90 xchg %ax,%ax
8048688: 83 eb 04 sub $0x4,%ebx
804868b: ff d0 call *%eax
804868d: 8b 03 mov (%ebx),%eax
804868f: 83 f8 ff cmp $0xffffffff,%eax
8048692: 75 f4 jne 8048688 <__do_global_ctors_aux+0x18>
8048694: 83 c4 04 add $0x4,%esp
8048697: 5b pop %ebx
8048698: 5d pop %ebp
8048699: c3 ret
804869a: 90 nop
804869b: 90 nop
Disassembly of section .fini:
0804869c <_fini>:
804869c: 55 push %ebp
804869d: 89 e5 mov %esp,%ebp
804869f: 53 push %ebx
80486a0: 83 ec 04 sub $0x4,%esp
80486a3: e8 00 00 00 00 call 80486a8 <_fini+0xc>
80486a8: 5b pop %ebx
80486a9: 81 c3 4c 19 00 00 add $0x194c,%ebx
80486af: e8 ac fd ff ff call 8048460 <__do_global_dtors_aux>
80486b4: 59 pop %ecx
80486b5: 5b pop %ebx
80486b6: c9 leave
80486b7: c3 ret
xylitol@XyliBox:~/Bureau$
crackme: file format elf32-i386
Disassembly of section .init:
08048370 <_init>:
8048370: 55 push %ebp
8048371: 89 e5 mov %esp,%ebp
8048373: 53 push %ebx
8048374: 83 ec 04 sub $0x4,%esp
8048377: e8 00 00 00 00 call 804837c <_init+0xc>
804837c: 5b pop %ebx
804837d: 81 c3 78 1c 00 00 add $0x1c78,%ebx
8048383: 8b 93 fc ff ff ff mov -0x4(%ebx),%edx
8048389: 85 d2 test %edx,%edx
804838b: 74 05 je 8048392 <_init+0x22>
804838d: e8 1e 00 00 00 call 80483b0 <__gmon_start__@plt>
8048392: e8 29 01 00 00 call 80484c0
8048397: e8 d4 02 00 00 call 8048670 <__do_global_ctors_aux>
804839c: 58 pop %eax
804839d: 5b pop %ebx
804839e: c9 leave
804839f: c3 ret
Disassembly of section .plt:
080483a0 <__gmon_start__@plt-0x10>:
80483a0: ff 35 f8 9f 04 08 pushl 0x8049ff8
80483a6: ff 25 fc 9f 04 08 jmp *0x8049ffc
80483ac: 00 00 add %al,(%eax)
...
080483b0 <__gmon_start__@plt>:
80483b0: ff 25 00 a0 04 08 jmp *0x804a000
80483b6: 68 00 00 00 00 push $0x0
80483bb: e9 e0 ff ff ff jmp 80483a0 <_init+0x30>
080483c0 <__libc_start_main@plt>:
80483c0: ff 25 04 a0 04 08 jmp *0x804a004
80483c6: 68 08 00 00 00 push $0x8
80483cb: e9 d0 ff ff ff jmp 80483a0 <_init+0x30>
080483d0
80483d0: ff 25 08 a0 04 08 jmp *0x804a008
80483d6: 68 10 00 00 00 push $0x10
80483db: e9 c0 ff ff ff jmp 80483a0 <_init+0x30>
080483e0
80483e0: ff 25 0c a0 04 08 jmp *0x804a00c
80483e6: 68 18 00 00 00 push $0x18
80483eb: e9 b0 ff ff ff jmp 80483a0 <_init+0x30>
080483f0 <__stack_chk_fail@plt>:
80483f0: ff 25 10 a0 04 08 jmp *0x804a010
80483f6: 68 20 00 00 00 push $0x20
80483fb: e9 a0 ff ff ff jmp 80483a0 <_init+0x30>
08048400
8048400: ff 25 14 a0 04 08 jmp *0x804a014
8048406: 68 28 00 00 00 push $0x28
804840b: e9 90 ff ff ff jmp 80483a0 <_init+0x30>
08048410
8048410: ff 25 18 a0 04 08 jmp *0x804a018
8048416: 68 30 00 00 00 push $0x30
804841b: e9 80 ff ff ff jmp 80483a0 <_init+0x30>
08048420
8048420: ff 25 1c a0 04 08 jmp *0x804a01c
8048426: 68 38 00 00 00 push $0x38
804842b: e9 70 ff ff ff jmp 80483a0 <_init+0x30>
Disassembly of section .text:
08048430 <_start>:
8048430: 31 ed xor %ebp,%ebp
8048432: 5e pop %esi
8048433: 89 e1 mov %esp,%ecx
8048435: 83 e4 f0 and $0xfffffff0,%esp
8048438: 50 push %eax
8048439: 54 push %esp
804843a: 52 push %edx
804843b: 68 00 86 04 08 push $0x8048600
8048440: 68 10 86 04 08 push $0x8048610
8048445: 51 push %ecx
8048446: 56 push %esi
8048447: 68 e4 84 04 08 push $0x80484e4
804844c: e8 6f ff ff ff call 80483c0 <__libc_start_main@plt>
8048451: f4 hlt
8048452: 90 nop
8048453: 90 nop
8048454: 90 nop
8048455: 90 nop
8048456: 90 nop
8048457: 90 nop
8048458: 90 nop
8048459: 90 nop
804845a: 90 nop
804845b: 90 nop
804845c: 90 nop
804845d: 90 nop
804845e: 90 nop
804845f: 90 nop
08048460 <__do_global_dtors_aux>:
8048460: 55 push %ebp
8048461: 89 e5 mov %esp,%ebp
8048463: 53 push %ebx
8048464: 83 ec 04 sub $0x4,%esp
8048467: 80 3d 28 a0 04 08 00 cmpb $0x0,0x804a028
804846e: 75 40 jne 80484b0 <__do_global_dtors_aux+0x50>
8048470: 8b 15 2c a0 04 08 mov 0x804a02c,%edx
8048476: b8 18 9f 04 08 mov $0x8049f18,%eax
804847b: 2d 14 9f 04 08 sub $0x8049f14,%eax
8048480: c1 f8 02 sar $0x2,%eax
8048483: 8d 58 ff lea -0x1(%eax),%ebx
8048486: 39 da cmp %ebx,%edx
8048488: 73 1f jae 80484a9 <__do_global_dtors_aux+0x49>
804848a: 8d b6 00 00 00 00 lea 0x0(%esi),%esi
8048490: 8d 42 01 lea 0x1(%edx),%eax
8048493: a3 2c a0 04 08 mov %eax,0x804a02c
8048498: ff 14 85 14 9f 04 08 call *0x8049f14(,%eax,4)
804849f: 8b 15 2c a0 04 08 mov 0x804a02c,%edx
80484a5: 39 da cmp %ebx,%edx
80484a7: 72 e7 jb 8048490 <__do_global_dtors_aux+0x30>
80484a9: c6 05 28 a0 04 08 01 movb $0x1,0x804a028
80484b0: 83 c4 04 add $0x4,%esp
80484b3: 5b pop %ebx
80484b4: 5d pop %ebp
80484b5: c3 ret
80484b6: 8d 76 00 lea 0x0(%esi),%esi
80484b9: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi
080484c0
80484c0: 55 push %ebp
80484c1: 89 e5 mov %esp,%ebp
80484c3: 83 ec 08 sub $0x8,%esp
80484c6: a1 1c 9f 04 08 mov 0x8049f1c,%eax
80484cb: 85 c0 test %eax,%eax
80484cd: 74 12 je 80484e1
80484cf: b8 00 00 00 00 mov $0x0,%eax
80484d4: 85 c0 test %eax,%eax
80484d6: 74 09 je 80484e1
80484d8: c7 04 24 1c 9f 04 08 movl $0x8049f1c,(%esp)
80484df: ff d0 call *%eax
80484e1: c9 leave
80484e2: c3 ret
80484e3: 90 nop
080484e4
80484e4: 8d 4c 24 04 lea 0x4(%esp),%ecx
80484e8: 83 e4 f0 and $0xfffffff0,%esp
80484eb: ff 71 fc pushl -0x4(%ecx)
80484ee: 55 push %ebp
80484ef: 89 e5 mov %esp,%ebp
80484f1: 57 push %edi
80484f2: 51 push %ecx
80484f3: 81 ec 90 00 00 00 sub $0x90,%esp
80484f9: 65 a1 14 00 00 00 mov %gs:0x14,%eax
80484ff: 89 45 f4 mov %eax,-0xc(%ebp)
8048502: 31 c0 xor %eax,%eax
8048504: c7 45 90 00 00 00 00 movl $0x0,-0x70(%ebp)
804850b: 8d 55 94 lea -0x6c(%ebp),%edx
804850e: 89 55 84 mov %edx,-0x7c(%ebp)
8048511: c7 45 80 00 00 00 00 movl $0x0,-0x80(%ebp)
8048518: b8 60 00 00 00 mov $0x60,%eax
804851d: 83 f8 04 cmp $0x4,%eax
8048520: 72 18 jb 804853a
8048522: c7 85 7c ff ff ff 18 movl $0x18,-0x84(%ebp)
8048529: 00 00 00
804852c: 8b 7d 84 mov -0x7c(%ebp),%edi
804852f: 8b 8d 7c ff ff ff mov -0x84(%ebp),%ecx
8048535: 8b 45 80 mov -0x80(%ebp),%eax
8048538: f3 ab rep stos %eax,%es:(%edi)
804853a: c7 04 24 c0 86 04 08 movl $0x80486c0,(%esp)
8048541: e8 9a fe ff ff call 80483e0
8048546: 8d 45 90 lea -0x70(%ebp),%eax
8048549: 89 44 24 04 mov %eax,0x4(%esp)
804854d: c7 04 24 ee 86 04 08 movl $0x80486ee,(%esp)
8048554: e8 77 fe ff ff call 80483d0
8048559: c7 44 24 04 f1 86 04 movl $0x80486f1,0x4(%esp)
8048560: 08
8048561: 8d 45 90 lea -0x70(%ebp),%eax
8048564: 89 04 24 mov %eax,(%esp)
8048567: e8 a4 fe ff ff call 8048410
804856c: 85 c0 test %eax,%eax
804856e: 75 24 jne 8048594
8048570: c7 04 24 fc 86 04 08 movl $0x80486fc,(%esp)
8048577: e8 84 fe ff ff call 8048400
804857c: c7 04 24 20 87 04 08 movl $0x8048720,(%esp)
8048583: e8 78 fe ff ff call 8048400
8048588: c7 04 24 01 00 00 00 movl $0x1,(%esp)
804858f: e8 8c fe ff ff call 8048420
8048594: c7 44 24 04 36 87 04 movl $0x8048736,0x4(%esp)
804859b: 08
804859c: 8d 45 90 lea -0x70(%ebp),%eax
804859f: 89 04 24 mov %eax,(%esp)
80485a2: e8 69 fe ff ff call 8048410
80485a7: 85 c0 test %eax,%eax
80485a9: 75 1a jne 80485c5
80485ab: c7 04 24 46 87 04 08 movl $0x8048746,(%esp)
80485b2: e8 49 fe ff ff call 8048400
80485b7: c7 04 24 58 87 04 08 movl $0x8048758,(%esp)
80485be: e8 3d fe ff ff call 8048400
80485c3: eb 18 jmp 80485dd
80485c5: c7 04 24 7c 87 04 08 movl $0x804877c,(%esp)
80485cc: e8 2f fe ff ff call 8048400
80485d1: c7 04 24 8c 87 04 08 movl $0x804878c,(%esp)
80485d8: e8 23 fe ff ff call 8048400
80485dd: b8 00 00 00 00 mov $0x0,%eax
80485e2: 8b 55 f4 mov -0xc(%ebp),%edx
80485e5: 65 33 15 14 00 00 00 xor %gs:0x14,%edx
80485ec: 74 05 je 80485f3
80485ee: e8 fd fd ff ff call 80483f0 <__stack_chk_fail@plt>
80485f3: 81 c4 90 00 00 00 add $0x90,%esp
80485f9: 59 pop %ecx
80485fa: 5f pop %edi
80485fb: 5d pop %ebp
80485fc: 8d 61 fc lea -0x4(%ecx),%esp
80485ff: c3 ret
08048600 <__libc_csu_fini>:
8048600: 55 push %ebp
8048601: 89 e5 mov %esp,%ebp
8048603: 5d pop %ebp
8048604: c3 ret
8048605: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi
8048609: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi
08048610 <__libc_csu_init>:
8048610: 55 push %ebp
8048611: 89 e5 mov %esp,%ebp
8048613: 57 push %edi
8048614: 56 push %esi
8048615: 53 push %ebx
8048616: e8 4f 00 00 00 call 804866a <__i686.get_pc_thunk.bx>
804861b: 81 c3 d9 19 00 00 add $0x19d9,%ebx
8048621: 83 ec 0c sub $0xc,%esp
8048624: e8 47 fd ff ff call 8048370 <_init>
8048629: 8d bb 18 ff ff ff lea -0xe8(%ebx),%edi
804862f: 8d 83 18 ff ff ff lea -0xe8(%ebx),%eax
8048635: 29 c7 sub %eax,%edi
8048637: c1 ff 02 sar $0x2,%edi
804863a: 85 ff test %edi,%edi
804863c: 74 24 je 8048662 <__libc_csu_init+0x52>
804863e: 31 f6 xor %esi,%esi
8048640: 8b 45 10 mov 0x10(%ebp),%eax
8048643: 89 44 24 08 mov %eax,0x8(%esp)
8048647: 8b 45 0c mov 0xc(%ebp),%eax
804864a: 89 44 24 04 mov %eax,0x4(%esp)
804864e: 8b 45 08 mov 0x8(%ebp),%eax
8048651: 89 04 24 mov %eax,(%esp)
8048654: ff 94 b3 18 ff ff ff call *-0xe8(%ebx,%esi,4)
804865b: 83 c6 01 add $0x1,%esi
804865e: 39 fe cmp %edi,%esi
8048660: 72 de jb 8048640 <__libc_csu_init+0x30>
8048662: 83 c4 0c add $0xc,%esp
8048665: 5b pop %ebx
8048666: 5e pop %esi
8048667: 5f pop %edi
8048668: 5d pop %ebp
8048669: c3 ret
0804866a <__i686.get_pc_thunk.bx>:
804866a: 8b 1c 24 mov (%esp),%ebx
804866d: c3 ret
804866e: 90 nop
804866f: 90 nop
08048670 <__do_global_ctors_aux>:
8048670: 55 push %ebp
8048671: 89 e5 mov %esp,%ebp
8048673: 53 push %ebx
8048674: 83 ec 04 sub $0x4,%esp
8048677: a1 0c 9f 04 08 mov 0x8049f0c,%eax
804867c: 83 f8 ff cmp $0xffffffff,%eax
804867f: 74 13 je 8048694 <__do_global_ctors_aux+0x24>
8048681: bb 0c 9f 04 08 mov $0x8049f0c,%ebx
8048686: 66 90 xchg %ax,%ax
8048688: 83 eb 04 sub $0x4,%ebx
804868b: ff d0 call *%eax
804868d: 8b 03 mov (%ebx),%eax
804868f: 83 f8 ff cmp $0xffffffff,%eax
8048692: 75 f4 jne 8048688 <__do_global_ctors_aux+0x18>
8048694: 83 c4 04 add $0x4,%esp
8048697: 5b pop %ebx
8048698: 5d pop %ebp
8048699: c3 ret
804869a: 90 nop
804869b: 90 nop
Disassembly of section .fini:
0804869c <_fini>:
804869c: 55 push %ebp
804869d: 89 e5 mov %esp,%ebp
804869f: 53 push %ebx
80486a0: 83 ec 04 sub $0x4,%esp
80486a3: e8 00 00 00 00 call 80486a8 <_fini+0xc>
80486a8: 5b pop %ebx
80486a9: 81 c3 4c 19 00 00 add $0x194c,%ebx
80486af: e8 ac fd ff ff call 8048460 <__do_global_dtors_aux>
80486b4: 59 pop %ecx
80486b5: 5b pop %ebx
80486b6: c9 leave
80486b7: c3 ret
xylitol@XyliBox:~/Bureau$
Souvenez-vous:
80485a2: e8 69 fe ff ff call 8048410
80485a7: 85 c0 test %eax,%eax
80485a9: 75 1a jne 80485c5
80485ab: c7 04 24 46 87 04 08 movl $0x8048746,(%esp)
80485a7: 85 c0 test %eax,%eax
80485a9: 75 1a jne 80485c5
80485ab: c7 04 24 46 87 04 08 movl $0x8048746,(%esp)
On va remplacer le JNE par un NOP, comme ça, on passe directe au good boy.
75 1a jne 80485c5
Mais comment on utilise hexedit ?
Appuyer sur Ctrl-S: (search forward)
Note: tapé info hexedit, info gdb, info objdump etc. pour voir le manuel
Cherchez en string hexa: 751AC7042446870408 (c'est le code hexa de la JNE et de la ligne d'en dessous)
Bon une fois dessus remplacé 75 1A par 90 90
Pour sauvegarder et quitter faite Ctrl-X
xylitol@XyliBox:~$ cd Bureau
xylitol@XyliBox:~/Bureau$ ./crackme
Give us the good code... or DIE !
Password : WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
Access Granted
We keep you alive, have a nice day
xylitol@XyliBox:~/Bureau$
xylitol@XyliBox:~/Bureau$ ./crackme
Give us the good code... or DIE !
Password : WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
Access Granted
We keep you alive, have a nice day
xylitol@XyliBox:~/Bureau$
That's all folks !
Bonus:
Trouvé sur le web, un script pour avoir un gdb qui ressemble a SoftIce.
Comme ça fais longtemps que j'ai pas write quelque chose et que je fais de la merde le voici:
Par soucis de plac, allez ici: http://dotfiles.org/~mkfs/.gdbinit
Bonus 2: gdb quick ref.pdf
Pas trop de texte beaucoup d'illustrations, j'ai essayé de faire en sorte que ça soit le plus compréhensible possible.
J'espère que cette balade dans nux vous aura plus ?
en tout cas pour moi une chose et sûr: rm -rf *
Merci à 5m0k3 et a NeoMorphS qui mon plus ou moins show gdb et objdump.
__
Xylitol le 13 Octobre 2009
interesting concept!
ReplyDeleteGood job, dude ! je l'avais pas encore lu celui ci .
ReplyDelete