TryHackMe-Advent-of-Cyber/22-If-Santa-Then-Christmas
Jump to navigation
Jump to search
| You are here | 22-If_Santa_Then_Christmas
|
[Day 22] If Santa, Then Christmas
Instructions
McSkidy has been faring on well so far with assembly - they got some inside knowledge that the christmas monster is weaponizing if statements. Can they get ahead of the curve?
These programs have been compiled to be executed on Linux x86-64 systems.
Check out the supporting material here.
The questions below relate to the if2 binary.
#1 - what is the value of local_8h before the end of the main function?
We are provided with a zip archive that contains 3 files, 2 of which (if1, if1.c) are used for the training material. To answer the questions, we need if2 only.
We’ll start by opening the binary in radare2 with the -d option (debug). Run aa to analyze all symbols and functions, and print the main function.
$ r2 -d ./if2
Process with PID 31085 started...
= attach 31085 31085
bin.baddr 0x00400000
Using 0x400000
asm.bits 64
-- The unix-like reverse engineering framework.
[0x00400a30]> aa
[Invalid address from 0x004843bcith sym. and entry0 (aa)
Invalid address from 0x0044efd6
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x00400a30]> pdf @main
; DATA XREF from entry0 @ 0x400a4d
┌ 43: int main (int argc, char **argv, char **envp);
│ ; var int64_t var_8h @ rbp-0x8
│ ; var int64_t var_4h @ rbp-0x4
│ 0x00400b4d 55 push rbp
│ 0x00400b4e 4889e5 mov rbp, rsp
│ 0x00400b51 c745f8080000. mov dword [var_8h], 8
│ 0x00400b58 c745fc020000. mov dword [var_4h], 2
│ 0x00400b5f 8b45f8 mov eax, dword [var_8h]
│ 0x00400b62 3b45fc cmp eax, dword [var_4h]
│ ┌─< 0x00400b65 7e06 jle 0x400b6d
│ │ 0x00400b67 8345f801 add dword [var_8h], 1
│ ┌──< 0x00400b6b eb04 jmp 0x400b71
│ │└─> 0x00400b6d 8345fc07 add dword [var_4h], 7
│ │ ; CODE XREF from main @ 0x400b6b
│ └──> 0x00400b71 b800000000 mov eax, 0
│ 0x00400b76 5d pop rbp
└ 0x00400b77 c3 ret
To see the value of local_8h before the end of the function, we’ll set a breakpoint at address 0x00400b76 and we’ll run the program.
[0x00400a30]> db 0x00400b76
[0x00400a30]> dc
hit breakpoint at: 400b76
[0x00400b76]> pdf @main
; DATA XREF from entry0 @ 0x400a4d
┌ 43: int main (int argc, char **argv, char **envp);
│ ; var int64_t var_8h @ rbp-0x8
│ ; var int64_t var_4h @ rbp-0x4
│ 0x00400b4d 55 push rbp
│ 0x00400b4e 4889e5 mov rbp, rsp
│ 0x00400b51 c745f8080000. mov dword [var_8h], 8
│ 0x00400b58 c745fc020000. mov dword [var_4h], 2
│ 0x00400b5f 8b45f8 mov eax, dword [var_8h]
│ 0x00400b62 3b45fc cmp eax, dword [var_4h]
│ ┌─< 0x00400b65 7e06 jle 0x400b6d
│ │ 0x00400b67 8345f801 add dword [var_8h], 1
│ ┌──< 0x00400b6b eb04 jmp 0x400b71
│ │└─> 0x00400b6d 8345fc07 add dword [var_4h], 7
│ │ ; CODE XREF from main @ 0x400b6b
│ └──> 0x00400b71 b800000000 mov eax, 0
│ ;-- rip:
│ 0x00400b76 b 5d pop rbp
└ 0x00400b77 c3 ret
[0x00400b76]> px @ rbp-0x8
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
0x7ffe3fbe50d8 0900 0000 0200 0000 5018 4000 0000 0000 ........P.@.....
0x7ffe3fbe50e8 f910 4000 0000 0000 0000 0000 0000 0000 ..@.............
0x7ffe3fbe50f8 0000 0000 0100 0000 0852 be3f fe7f 0000 .........R.?....
0x7ffe3fbe5108 4d0b 4000 0000 0000 0000 0000 0000 0000 M.@.............
0x7ffe3fbe5118 0600 0000 3c00 0000 3000 0000 0300 0000 ....<...0.......
0x7ffe3fbe5128 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe5138 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe5148 0000 0000 0000 0000 0004 4000 0000 0000 ..........@.....
0x7ffe3fbe5158 6b7f ab22 d871 bcf0 f018 4000 0000 0000 k..".q....@.....
0x7ffe3fbe5168 0000 0000 0000 0000 1890 6b00 0000 0000 ..........k.....
0x7ffe3fbe5178 0000 0000 0000 0000 6b7f ebb3 240e 400f ........k...$.@.
0x7ffe3fbe5188 6b7f 5f33 d871 bcf0 0000 0000 0000 0000 k._3.q..........
0x7ffe3fbe5198 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe51a8 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe51b8 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe51c8 0000 0000 0000 0000 0000 0000 0000 0000 ................
Before the end of the main function, local_8h is equal to 9 (0x7ffe3fbe50d8 09......).
#2 - what is the value of local_4h before the end of the main function?
[0x00400b76]> px @ rbp-0x4
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
0x7ffe3fbe50dc 0200 0000 5018 4000 0000 0000 f910 4000 ....P.@.......@.
0x7ffe3fbe50ec 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe50fc 0100 0000 0852 be3f fe7f 0000 4d0b 4000 .....R.?....M.@.
0x7ffe3fbe510c 0000 0000 0000 0000 0000 0000 0600 0000 ................
0x7ffe3fbe511c 3c00 0000 3000 0000 0300 0000 0000 0000 <...0...........
0x7ffe3fbe512c 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe513c 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe514c 0000 0000 0004 4000 0000 0000 6b7f ab22 [email protected].."
0x7ffe3fbe515c d871 bcf0 f018 4000 0000 0000 0000 0000 .q....@.........
0x7ffe3fbe516c 0000 0000 1890 6b00 0000 0000 0000 0000 ......k.........
0x7ffe3fbe517c 0000 0000 6b7f ebb3 240e 400f 6b7f 5f33 [email protected]._3
0x7ffe3fbe518c d871 bcf0 0000 0000 0000 0000 0000 0000 .q..............
0x7ffe3fbe519c 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe51ac 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe51bc 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x7ffe3fbe51cc 0000 0000 0000 0000 0000 0000 0000 0000 ................
And local_4h is equal to 2
Reverse engineering the binary
Below are the commented disassembled code and the equivalent in C:
┌ 43: int main (int argc, char **argv, char **envp);
│ ; var int64_t var_8h @ rbp-0x8
│ ; var int64_t var_4h @ rbp-0x4
│ 0x00400b4d 55 push rbp ; function prologue
│ 0x00400b4e 4889e5 mov rbp, rsp ; function prologue
│ 0x00400b51 c745f8080000. mov dword [var_8h], 8 ; a = 8
│ 0x00400b58 c745fc020000. mov dword [var_4h], 2 ; b = 2
│ 0x00400b5f 8b45f8 mov eax, dword [var_8h] ; eax = 8
│ 0x00400b62 3b45fc cmp eax, dword [var_4h] ; if 8 <= 2
│ ┌─< 0x00400b65 7e06 jle 0x400b6d ; go to 0x400b6d (will not jump)
│ │ 0x00400b67 8345f801 add dword [var_8h], 1 ; else a += 1 (a = 9)
│ ┌──< 0x00400b6b eb04 jmp 0x400b71 : goto end
│ │└─> 0x00400b6d 8345fc07 add dword [var_4h], 7 ; 0x400b6d: b+=7 (will never happen)
│ │ ; CODE XREF from main @ 0x400b6b
│ └──> 0x00400b71 b800000000 mov eax, 0
│ 0x00400b76 5d pop rbp ; function epilogue
└ 0x00400b77 c3 ret ; function epilogue
#include <stdio.h>
int main(void){
int a = 8;
int b = 2;
if(a > b){
a += 1;
}
else{
b += 7;
}
return 0;