IOLI 0x01
This is the second IOLI crackme.
$ ./crackme0x01
IOLI Crackme Level 0x01
Password: test
Invalid Password!
Let's check for strings with rabin2.
$ rabin2 -z ./crackme0x01
vaddr=0x08048528 paddr=0x00000528 ordinal=000 sz=25 len=24 section=.rodata type=a string=IOLI Crackme Level 0x01\n
vaddr=0x08048541 paddr=0x00000541 ordinal=001 sz=11 len=10 section=.rodata type=a string=Password:
vaddr=0x0804854f paddr=0x0000054f ordinal=002 sz=19 len=18 section=.rodata type=a string=Invalid Password!\n
vaddr=0x08048562 paddr=0x00000562 ordinal=003 sz=16 len=15 section=.rodata type=a string=Password OK :)\n
This isn't going to be as easy as 0x00. Let's try disassembly with r2.
$ r2 ./crackme0x01 -- Use `zoom.byte=printable` in zoom mode ('z' in Visual mode) to find strings
[0x08048330]> aa
[0x08048330]> pdf@main
/ (fcn) main 113
| ; var int local_4 @ ebp-0x4
| ; DATA XREF from 0x08048347 (entry0)
| 0x080483e4 55 push ebp
| 0x080483e5 89e5 mov ebp, esp
| 0x080483e7 83ec18 sub esp, 0x18
| 0x080483ea 83e4f0 and esp, -0x10
| 0x080483ed b800000000 mov eax, 0
| 0x080483f2 83c00f add eax, 0xf
| 0x080483f5 83c00f add eax, 0xf
| 0x080483f8 c1e804 shr eax, 4
| 0x080483fb c1e004 shl eax, 4
| 0x080483fe 29c4 sub esp, eax
| 0x08048400 c7042428850. mov dword [esp], str.IOLI_Crackme_Level_0x01_n ; [0x8048528:4]=0x494c4f49 ; "IOLI Crackme Level 0x01." @ 0x8048528
| 0x08048407 e810ffffff call sym.imp.printf
| sym.imp.printf(unk)
| 0x0804840c c7042441850. mov dword [esp], str.Password_ ; [0x8048541:4]=0x73736150 ; "Password: " @ 0x8048541
| 0x08048413 e804ffffff call sym.imp.printf
| sym.imp.printf()
| 0x08048418 8d45fc lea eax, dword [ebp + 0xfffffffc]
| 0x0804841b 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101
| 0x0804841f c704244c850. mov dword [esp], 0x804854c ; [0x804854c:4]=0x49006425 ; "%d" @ 0x804854c
| 0x08048426 e8e1feffff call sym.imp.scanf
| sym.imp.scanf()
| 0x0804842b 817dfc9a140. cmp dword [ebp + 0xfffffffc], 0x149a
| ,=< 0x08048432 740e je 0x8048442
| | 0x08048434 c704244f850. mov dword [esp], str.Invalid_Password__n ; [0x804854f:4]=0x61766e49 ; "Invalid Password!." @ 0x804854f
| | 0x0804843b e8dcfeffff call sym.imp.printf
| | sym.imp.printf()
| ,==< 0x08048440 eb0c jmp 0x804844e ; (main)
| || ; JMP XREF from 0x08048432 (main)
| |`-> 0x08048442 c7042462850. mov dword [esp], str.Password_OK____n ; [0x8048562:4]=0x73736150 ; "Password OK :)." @ 0x8048562
| | 0x08048449 e8cefeffff call sym.imp.printf
| | sym.imp.printf()
| | ; JMP XREF from 0x08048440 (main)
| `--> 0x0804844e b800000000 mov eax, 0
| 0x08048453 c9 leave
\ 0x08048454 c3 ret
"aa" tells r2 to analyze the whole binary, which gets you symbol names, among things.
"pdf" stands for
Print
Disassemble
Function
This will print the disassembly of the main function, or the main() that everyone knows. You can see several things as well: weird names, arrows, etc.
"imp." stands for imports. Those are imported symbols, like printf()
"str." stands for strings. Those are strings (obviously).
If you look carefully, you'll see a cmp instruction, with a constant, 0x149a. cmp is an x86 compare instruction, and the 0x in front of it specifies it is in base 16, or hex (hexadecimal).
0x0804842b 817dfc9a140. cmp dword [ebp + 0xfffffffc], 0x149a
You can use radare2's ? command to get it in another numeric base.
[0x08048330]> ? 0x149a
5274 0x149a 012232 5.2K 0000:049a 5274 10011010 5274.0 0.000000
So now we know that 0x149a is 5274 in decimal. Let's try this as a password.
$ ./crackme0x01
IOLI Crackme Level 0x01
Password: 5274
Password OK :)
Bingo, the password was 5274. In this case, the password function at 0x0804842b was comparing the input against the value, 0x149a in hex. Since user input is usually decimal, it was a safe bet that the input was intended to be in decimal, or 5274. Now, since we're hackers, and curiosity drives us, let's see what happens when we input in hex.
$ ./crackme0x01
IOLI Crackme Level 0x01
Password: 0x149a
Invalid Password!
It was worth a shot, but it doesn't work. That's because scanf() will take the 0 in 0x149a to be a zero, rather than accepting the input as actually being the hex value.
And this concludes IOLI 0x01.