IOLI 0x06

nearly a routine to check this binary (not complete output in the following):

  1. rabin2 -z ./crackme0x06
  2. [Strings]
  3. nth paddr      vaddr      len size section type  string
  4. -------------------------------------------------------
  5. 0   0x00000738 0x08048738 4   5    .rodata ascii LOLO
  6. 1   0x00000740 0x08048740 13  14   .rodata ascii Password OK!\n
  7. 2   0x0000074e 0x0804874e 20  21   .rodata ascii Password Incorrect!\n
  8. 3   0x00000763 0x08048763 24  25   .rodata ascii IOLI Crackme Level 0x06\n
  9. 4   0x0000077c 0x0804877c 10  11   .rodata ascii Password:
  11. rabin2 -I ./crackme0x06
  12. arch     x86
  13. baddr    0x8048000
  14. bintype  elf
  15. bits     32
  16. compiler GCC: (GNU) 3.4.6 (Gentoo 3.4.6-r2, ssp-3.4.6-1.0, pie-8.7.10)
  17. crypto   false
  18. endian   little
  19. havecode true
  20. lang     c
  21. machine  Intel 80386
  22. maxopsz  16
  23. minopsz  1
  24. os       linux
  25. static   false
  26. va       true

and analyze it then decompile main

  1. [0x08048400]> pdd@main
  2. /* r2dec pseudo code output */
  3. /* ./crackme0x06 @ 0x8048607 */
  4. #include <stdint.h>
  6. int32_t main (int32_t arg_10h) {
  7.     int32_t var_78h;
  8.     int32_t var_4h;
  9.     // adjusting stack
  10.     eax = 0;
  11.     eax += 0xf;
  12.     eax += 0xf;
  13.     eax >>= 4;
  14.     eax <<= 4;
  16.     // main logic
  17.     printf ("IOLI Crackme Level 0x06\n");
  18.     printf ("Password: ");
  19.     eax = &var_78h;
  20.     scanf (0x8048787, eax);
  21.     eax = arg_10h;
  22.     eax = &var_78h;
  23.     check (eax, arg_10h);
  24.     eax = 0;
  25.     return eax;
  26. }

main has 3 arguments argc, argv, envp, and this program is compiled with GCC, so the stack should be like this :

  1. [esp + 0x10] - envp
  2. [esp + 0x0c] - argv
  3. [esp + 0x08] - argc
  4. [esp + 0x04] - return address

enter the check() and decompile it. this function is different from 0x05 now. but they still have similar code structure.

  1. int32_t check (char * s, int32_t arg_ch) {
  2.     char * var_dh;
  3.     uint32_t var_ch;
  4.     uint32_t var_8h;
  5.     int32_t var_4h;
  6.     char * format;
  7.     int32_t var_sp_8h;
  8.     var_8h = 0;
  9.     var_ch = 0;
  10.     do {
  11.         eax = s;
  12.         eax = strlen (eax);
  13.         if (var_ch >= eax) {
  14.             goto label_0;
  15.         }
  16.         eax = var_ch;
  17.         eax += s;
  18.         eax = *(eax);
  19.         var_dh = al;
  20.         eax = &var_4h;
  21.         eax = &var_dh;
  22.         sscanf (eax, eax, 0x804873d);
  23.         edx = var_4h;
  24.         eax = &var_8h;
  25.         *(eax) += edx;
  26.         if (var_8h == 0x10) {
  27.             eax = arg_ch;
  28.             eax = s;
  29.             parell (eax, arg_ch);
  30.         }
  31.         eax = &var_ch;
  32.         *(eax)++;
  33.     } while (1);
  34. label_0:
  35.     printf ("Password Incorrect!\n");
  36.     return eax;
  37. }

Correct the sscanf part and parell part, both of them were generated incorrectly:

  1. int32_t check (char * s, void* envp)
  2. {
  3.     var_ch = 0;
  4.     var_8h = 0;
  5.     for (var_ch = 0; var_ch < strlen(s); ++var_ch)
  6.     {
  7.         var_dh = s[var_ch];
  8.         sscanf(&var_dh, %d, &var_4h);            // read from string[var_ch], store to var_4h
  9.         var_8h += var_4h;
  10.         if(var_8h == 0x10)
  11.             parell(s, envp);
  12.     }
  13.     printf("Password Incorrect!\n");
  14.     return 0;
  15. }

no more info, we have to reverse parell() again.

  1. #include <stdint.h>
  3. uint32_t parell (char * s, char * arg_ch) {
  4.     sscanf (s, %d, &var_4h);
  6.     if (dummy (var_4h, arg_ch) == 0)
  7.         return 0;
  9.     for (var_bp_8h = 0; var_bp_8h <= 9; ++var_bp_8h){
  10.         if (var_4h & 1 == 0){
  11.             printf("Password OK!\n");
  12.             exit(0);
  13.         }
  14.     }
  16.     return 0;
  17. }

well, there is a new check condition in parell() — dummy (var_4h, arg_ch) == 0. then reverse dummy!

  1. [0x080484b4]> pdd@sym.dummy
  2. /* r2dec pseudo code output */
  3. /* ./crackme0x06 @ 0x80484b4 */
  4. #include <stdint.h>
  6. int32_t dummy (char ** s1) {
  7.     int32_t var_8h;
  8.     int32_t var_4h;
  9.     char * s2;
  10.     size_t * n;
  11.     var_4h = 0;
  12.     do {
  13.         eax = 0;
  14.         edx = eax*4;
  15.         eax = s1;
  16.         if (*((edx + eax)) == 0) {
  17.             goto label_0;
  18.         }
  19.         eax = var_4h;
  20.         ecx = eax*4;
  21.         edx = s1;
  22.         eax = &var_4h;
  23.         *(eax)++;
  24.         eax = *((ecx + edx));
  25.         eax = strncmp (eax, 3, "LOLO");
  26.     } while (eax != 0);
  27.     var_8h = 1;
  28.     goto label_1;
  29. label_0:
  30.     var_8h = 0;
  31. label_1:
  32.     eax = 0;
  33.     return eax;
  34. }

looks like a loop to process string. we can beautify it.

  1. [0x080484b4]> pdd@sym.dummy
  2. /* r2dec pseudo code output */
  3. /* ./crackme0x06 @ 0x80484b4 */
  4. #include <stdint.h>
  6. int32_t dummy (char ** s1) {
  7.     for (var_4h = 0; strncmp(s1[var_4h], "LOLO", 3) != 0; var_4h++){
  8.         if (s1[i] == NULL)
  9.             return 0;
  10.     }
  11.     return 1;
  12. }

There are 3 constraints to crackme_0x06:

  • Digit Sum
  • Odd Number
  • should have an environment variable whose name started with “LOL”.
  1. $ ./crackme0x06
  2. IOLI Crackme Level 0x06
  3. Password: 12346
  4. Password Incorrect!
  5. $ export LOLAA=help
  6. $ ./cracke0x06
  7. IOLI Crackme Level 0x06
  8. Password: 12346
  9. Password OK!