Reversing and Cracking first simple Program - bin 0x05

Key Takeaways

[Music] I have written a small C program it's supposed to be a simple license check so you can execute it and you can supply a key as an argument and it will be checked our goal is to crack this program so we don't have to use a valid license key I've made this program available through a GitHub repository you can download from gab.com overflow and the repository name life overflow YouTube or you can install git with sud sudo appg install git and get the whole repository with Git clone and the address you can see on GitHub we will probably talk more about what get is later for now it's enough to know that it's a way how developers can program together on a project and I use it to share some stuff to have a look at the binary assembly code we can use a program called GDB the new debugger so type GDB and the path to the binary so every C program has a main function remember so let's type in disassemble main which will display all assembler instructions from the main function but do you see how ugly that looks that's horrible horrible AT&T syntax so type in set disassembly flavor Intel remember that you can use tab completion here as well now disassemble main again and now it's much more readable okay so it looks complicated but you can ignore most of it first of all get a higher level view of it it doesn't make sense to start going through this instruction by instruction this main function obviously calls other functions so just draw a mental picture of the rough control flow I will actually print out this assembler code and use a pen that's how I did it in the beginning and still do it when I counter more complex code and remember to just ignore most of the stuff concentrate on the actual flow so at this start it arrives at a compare with number two and afterwards a jump not equal so something is checked if it is two if that is the case we proceed to a print F which we know is a function to display text then comes a string compare if you don't know that function read the man page of it Man 3 string compare so this Compares two strings and returns zero if both strings were the same after that call we see another jump not equal so if the zero flag is not said there will be a puts call use the main page to figure out what it does but it just prints text like printer so if the original compare with the number two was not true then it would jump to the address 4623 so in that case it prints some other text with puts and exits I always add the address or at least part of the address from important locations so I know where I am this will help you later when we step through the program now we have one branch missing which also just prints text some jumps are still missing but you can add them to get a nice control flow graph now let's actually execute this and step through it you can then draw which path through the graph you have taken on your paper to do this we first set a break point at the start of main with break main breakpoint is set now use run to start the program starting the program and we hit the breakpoint one at this address a breakpoint is a point where execution stops now look at the registers with info registers here you can see the RP uh the the instruction pointer points to the first address in main now use SI to Step One instruction now we are at the new address in main info registers and you see the changed instruction pointer so now just step through it and follow the addresses in your control graph but use ni i instead of Si because Si would step into function calls but we only want to step through this main function and not follow stuff like puts okay did you notice when we jumped the jump was at 5D 0 and then the next instruction was at 623 so we followed the jump which means whatever was compared to two was not two and then the program printed the usage information after 628 which was the last puts call so we can write down that this puts prints the usage information now it's pretty clear that we didn't pass a key to this program which means the check was looking at the arguments if we supplied a license key so let's run the program again but this time with a random license key yes we want to start the program again now do the same n i and I and I now we are at 5D 0 again will we jump this time no cool so the next Branch we expect is at 609 let's an i and see what happens ah another print text so that print f is the info that a license key will be checked n i now comes the branch okay we are arrived at 609 let's see where we are afterwards at 617 so we did jump which means that the string compare failed and when we continue with an i we see that it's wrong okay let's set a breakpoint just before the last compare and run the program again remember that you can easily copy and paste values in the terminal by simply marking something and pressing your mouse wheel now run again break point one now continue this will run the program normally again until we hit the next breakpoint now it stopped before we execute the test eax eax eax just refers to the first 32-bit of the 64-bit Rax register so its value is hex e let's set this to zero which would indicate that the string compare was correct and returned zero set dollar E equals to zero info registers and you see that it's now zero now use an i again to step and follow your control path access granted yay so we circumvented the license check and you can always write your own little C program trying to make it more secure and then crack it yourself again you will notice that it's impossible to make a program uncrackable those kind of challenges are called crack me people create small programs that have to be cracked or more often you have to create a valid key again if you think something like this is fun check out Crack m.de creating control graphs like we just did is pretty useful that's why there are some programs that do that for us here are three different example of this specific control graph first is from the hopper disassembler second is from Ida and the last one is from radar it see you hopefully next time when we use some different tools to explore this license check binary a bit more [Music]