Comments (1)
The first part (I used input AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
because there is a length check):
gdb-peda$ context
[----------------------------------registers-----------------------------------]
EAX: 0xffffd9a4 ("ahJd\024\032G\031\003r6\bl\033.jl\032UghvFd{\035P\177gc\022\005a\005")
EBX: 0x1e
ECX: 0x0
EDX: 0x3c ('<')
ESI: 0xffffd9d4 ('A' <repeats 30 times>, "\n")
EDI: 0x0
EBP: 0x0
ESP: 0xffffd9a4 ("ahJd\024\032G\031\003r6\bl\033.jl\032UghvFd{\035P\177gc\022\005a\005")
EIP: 0x8048121 (mov dl,BYTE PTR [eax])
EFLAGS: 0x297 (CARRY PARITY ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x804811b: xor ecx,ecx
0x804811d: cmp ecx,ebx
0x804811f: jge 0x8048131
=> 0x8048121: mov dl,BYTE PTR [eax]
0x8048123: xor dl,BYTE PTR [esi+ecx*1]
0x8048126: mov BYTE PTR [esi+ecx*1],dl
0x8048129: add eax,0x1
0x804812c: add ecx,0x1
[------------------------------------stack-------------------------------------]
0000| 0xffffd9a4 ("ahJd\024\032G\031\003r6\bl\033.jl\032UghvFd{\035P\177gc\022\005a\005")
0004| 0xffffd9a8 --> 0x19471a14
0008| 0xffffd9ac --> 0x8367203
0012| 0xffffd9b0 --> 0x6a2e1b6c
0016| 0xffffd9b4 --> 0x67551a6c
0020| 0xffffd9b8 ("hvFd{\035P\177gc\022\005a\005")
0024| 0xffffd9bc --> 0x7f501d7b
0028| 0xffffd9c0 --> 0x5126367
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
gdb-peda$ x /30bx $eax
0xffffd9a4: 0x61 0x68 0x4a 0x64 0x14 0x1a 0x47 0x19
0xffffd9ac: 0x03 0x72 0x36 0x08 0x6c 0x1b 0x2e 0x6a
0xffffd9b4: 0x6c 0x1a 0x55 0x67 0x68 0x76 0x46 0x64
0xffffd9bc: 0x7b 0x1d 0x50 0x7f 0x67 0x63
The second part:
gdb-peda$
[----------------------------------registers-----------------------------------]
EAX: 0x0
EBX: 0x1e
ECX: 0x1d
EDX: 0x22 ('"')
ESI: 0xffffd9d4 (" )\v%U[\006XB3wI-Zo+-[\024&)7\a%:\\\021>&\"\n")
EDI: 0x8049bcc (xor ebp,DWORD PTR [ebx])
EBP: 0x0
ESP: 0xffffd9cc --> 0x1d
EIP: 0x8048053 (mov edx,edi)
EFLAGS: 0x206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x804804d: xor eax,eax
0x804804f: test ecx,ecx
0x8048051: je 0x8048064
=> 0x8048053: mov edx,edi
0x8048055: add edx,ecx
0x8048057: mov bl,BYTE PTR [edx]
0x8048059: mov edx,esi
0x804805b: add edx,ecx
[------------------------------------stack-------------------------------------]
0000| 0xffffd9cc --> 0x1d
0004| 0xffffd9d0 --> 0x8048145 (test eax,eax)
0008| 0xffffd9d4 (" )\v%U[\006XB3wI-Zo+-[\024&)7\a%:\\\021>&\"\n")
0012| 0xffffd9d8 --> 0x58065b55
0016| 0xffffd9dc ("B3wI-Zo+-[\024&)7\a%:\\\021>&\"\n")
0020| 0xffffd9e0 ("-Zo+-[\024&)7\a%:\\\021>&\"\n")
0024| 0xffffd9e4 --> 0x26145b2d
0028| 0xffffd9e8 --> 0x25073729
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
0x08048053 in ?? ()
gdb-peda$ x /30bx $edi
0x8049bcc: 0x33 0x2b 0x79 0x49 0x26 0x2a 0x76 0x2f
0x8049bd4: 0x2e 0x2b 0x73 0x49 0x24 0x36 0x6a 0x2b
0x8049bdc: 0x38 0x49 0x78 0x25 0x2d 0x22 0x12 0x21
0x8049be4: 0x29 0x30 0x12 0x30 0x2e 0x2a
Basically what the "reversed" binary does is it validates if *edi+count - *esi+count == 0
(byte ptr, see the disassembly around 0x8048053
) where esi
points to the string which is obtained previously with xoring input ^ eax
. See the output from the first string above (0x8048123
).
from ctf-notes.
Related Issues (3)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ctf-notes.