22.2.4 Level 0x03 - Use the debugger

Let's run the crackme:

 $ ./crackme0x03
 IOLI Crackme Level 0x03
 Password: foo
 Invalid Password!

As we can see, the goal is to patch the binary file to accept any password. We will proceed as in the previous level, first we open the file with radare, change the seek to sym.main and create a code graph:

 $ radare crackme0x03
 open ro crackme0x03
 Adding strings & symbol flags for crackme0x03
 17 symbols added.
 7 strings added.
 [0x08048360]> s sym.main
 [0x08048498]> ag

TODO: http://radare.nopcode.org/img/wk/crackme0x03-sym.main.png

We can see here that the main function calls a new function test() before exiting, let's graph it:

 [0x08048498]> s sym.test
 [0x0804846E]> pG

TODO: http://radare.nopcode.org/img/wk/crackme0x03-sym.test.png

Let's have a look at the disassembly:

TODO: http://radare.nopcode.org/img/wk/crackme0x03-pD_sym.test.png

As you might have noticed, here the strings have been scrambled so we don't know which code block is the one we have to force the flow go through. Instead of printf() here the crackme uses the function shift() which will unscramble the strings, containing the "password OK" or "Invalid password" messages.

From what we have learned on the previous solutions, if the "password OK" block is the one on the right side (green arrow) we'll have to patch the "jz" at offset 0x0804847A and make it a "jmp", but if the "password OK" block is the one on the left side (red arrow), then we'll need to nop the "jz".

Of course you can just nop it and if it doesn't work, then make it always jump... or you can also follow the disassembly of the function shift() to see how the strings are unscrambled. We'll go through the long path and let the radare built-in debugger do the job for us, so you'll learn the basic functionality of the radare debugger here.

Close the existing radare session, and open the file in debugger mode, to do this just add dbg:// before the filename:

 $ radare -d ./crackme0x03
 argv = 'crackme0x03', 
 Program 'crackme0x03' loaded.
 open debugger ro crackme0x03
 Adding strings & symbol flags for crackme0x03
 17 symbols added.
 7 strings added.
 17 symbols added.
 0xffffe000 - 0xfffff000 r-x- 0x00001000 [vdso]
 0xffffe000 - 0xfffff000 r-x- 0x00001000 [vdso]
 0xbff0c000 - 0xbff21000 rw-- 0x00015000 [stack]
 0xb7fb8000 - 0xb7fba000 rw-- 0x00002000 /lib/ld-2.6.1.so
 0xb7f9e000 - 0xb7fb8000 r-x- 0x0001a000 /lib/ld-2.6.1.so
 0x08049000 - 0x0804b000 rw-u 0x00002000 /home/pau/tmp/IOLI-crackme/bin-linux/crackme0x03
 0x08048000 - 0x08049000 r-xu 0x00001000 /home/pau/tmp/IOLI-crackme/bin-linux/crackme0x03
 flag 'entry' at 0x08048360 and size 200
 [0xB7F9E810]> 

TODO... UNFINISHED