diff --git a/level07/Ressources/disass_main.txt b/level07/Ressources/disass_main.txt new file mode 100644 index 0000000..bb4c8a4 --- /dev/null +++ b/level07/Ressources/disass_main.txt @@ -0,0 +1,185 @@ +Dump of assembler code for function main: + 0x08048723 : push ebp + 0x08048724 : mov ebp,esp + 0x08048726 : push edi + 0x08048727 : push esi + 0x08048728 : push ebx + 0x08048729 : and esp,0xfffffff0 + 0x0804872c : sub esp,0x1d0 + 0x08048732 : mov eax,DWORD PTR [ebp+0xc] + 0x08048735 : mov DWORD PTR [esp+0x1c],eax + 0x08048739 : mov eax,DWORD PTR [ebp+0x10] + 0x0804873c : mov DWORD PTR [esp+0x18],eax + 0x08048740 : mov eax,gs:0x14 + 0x08048746 : mov DWORD PTR [esp+0x1cc],eax + 0x0804874d : xor eax,eax + 0x0804874f : mov DWORD PTR [esp+0x1b4],0x0 + 0x0804875a : mov DWORD PTR [esp+0x1b8],0x0 + 0x08048765 : mov DWORD PTR [esp+0x1bc],0x0 + 0x08048770 : mov DWORD PTR [esp+0x1c0],0x0 + 0x0804877b : mov DWORD PTR [esp+0x1c4],0x0 + 0x08048786 : mov DWORD PTR [esp+0x1c8],0x0 + 0x08048791 : lea ebx,[esp+0x24] + 0x08048795 : mov eax,0x0 + 0x0804879a : mov edx,0x64 + 0x0804879f : mov edi,ebx + 0x080487a1 : mov ecx,edx + 0x080487a3 : rep stos DWORD PTR es:[edi],eax + 0x080487a5 : jmp 0x80487ea + 0x080487a7 : mov eax,DWORD PTR [esp+0x1c] + 0x080487ab : mov eax,DWORD PTR [eax] + 0x080487ad : mov DWORD PTR [esp+0x14],0xffffffff + 0x080487b5 : mov edx,eax + 0x080487b7 : mov eax,0x0 + 0x080487bc : mov ecx,DWORD PTR [esp+0x14] + 0x080487c0 : mov edi,edx + 0x080487c2 : repnz scas al,BYTE PTR es:[edi] + 0x080487c4 : mov eax,ecx + 0x080487c6 : not eax + 0x080487c8 : lea edx,[eax-0x1] + 0x080487cb : mov eax,DWORD PTR [esp+0x1c] + 0x080487cf : mov eax,DWORD PTR [eax] + 0x080487d1 : mov DWORD PTR [esp+0x8],edx + 0x080487d5 : mov DWORD PTR [esp+0x4],0x0 + 0x080487dd : mov DWORD PTR [esp],eax + 0x080487e0 : call 0x80484f0 + 0x080487e5 : add DWORD PTR [esp+0x1c],0x4 + 0x080487ea : mov eax,DWORD PTR [esp+0x1c] + 0x080487ee : mov eax,DWORD PTR [eax] + 0x080487f0 : test eax,eax + 0x080487f2 : jne 0x80487a7 + 0x080487f4 : jmp 0x8048839 + 0x080487f6 : mov eax,DWORD PTR [esp+0x18] + 0x080487fa : mov eax,DWORD PTR [eax] + 0x080487fc : mov DWORD PTR [esp+0x14],0xffffffff + 0x08048804 : mov edx,eax + 0x08048806 : mov eax,0x0 + 0x0804880b : mov ecx,DWORD PTR [esp+0x14] + 0x0804880f : mov edi,edx + 0x08048811 : repnz scas al,BYTE PTR es:[edi] + 0x08048813 : mov eax,ecx + 0x08048815 : not eax + 0x08048817 : lea edx,[eax-0x1] + 0x0804881a : mov eax,DWORD PTR [esp+0x18] + 0x0804881e : mov eax,DWORD PTR [eax] + 0x08048820 : mov DWORD PTR [esp+0x8],edx + 0x08048824 : mov DWORD PTR [esp+0x4],0x0 + 0x0804882c : mov DWORD PTR [esp],eax + 0x0804882f : call 0x80484f0 + 0x08048834 : add DWORD PTR [esp+0x18],0x4 + 0x08048839 : mov eax,DWORD PTR [esp+0x18] + 0x0804883d : mov eax,DWORD PTR [eax] + 0x0804883f : test eax,eax + 0x08048841 : jne 0x80487f6 + 0x08048843 : mov DWORD PTR [esp],0x8048b38 + 0x0804884a : call 0x80484c0 + 0x0804884f : mov eax,0x8048d4b + 0x08048854 : mov DWORD PTR [esp],eax + 0x08048857 : call 0x8048470 + 0x0804885c : mov DWORD PTR [esp+0x1b4],0x1 + 0x08048867 : mov eax,ds:0x804a040 + 0x0804886c : mov DWORD PTR [esp+0x8],eax + 0x08048870 : mov DWORD PTR [esp+0x4],0x14 + 0x08048878 : lea eax,[esp+0x1b8] + 0x0804887f : mov DWORD PTR [esp],eax + 0x08048882 : call 0x80484a0 + 0x08048887 : lea eax,[esp+0x1b8] + 0x0804888e : mov DWORD PTR [esp+0x14],0xffffffff + 0x08048896 : mov edx,eax + 0x08048898 : mov eax,0x0 + 0x0804889d : mov ecx,DWORD PTR [esp+0x14] + 0x080488a1 : mov edi,edx + 0x080488a3 : repnz scas al,BYTE PTR es:[edi] + 0x080488a5 : mov eax,ecx + 0x080488a7 : not eax + 0x080488a9 : sub eax,0x1 + 0x080488ac : sub eax,0x1 + 0x080488af : mov BYTE PTR [esp+eax*1+0x1b8],0x0 + 0x080488b7 : lea eax,[esp+0x1b8] + 0x080488be : mov edx,eax + 0x080488c0 : mov eax,0x8048d5b + 0x080488c5 : mov ecx,0x5 + 0x080488ca : mov esi,edx + 0x080488cc : mov edi,eax + 0x080488ce : repz cmps BYTE PTR ds:[esi],BYTE PTR es:[edi] + 0x080488d0 : seta dl + 0x080488d3 : setb al + 0x080488d6 : mov ecx,edx + 0x080488d8 : sub cl,al + 0x080488da : mov eax,ecx + 0x080488dc : movsx eax,al + 0x080488df : test eax,eax + 0x080488e1 : jne 0x80488f8 + 0x080488e3 : lea eax,[esp+0x24] + 0x080488e7 : mov DWORD PTR [esp],eax + 0x080488ea : call 0x8048630 + 0x080488ef : mov DWORD PTR [esp+0x1b4],eax + 0x080488f6 : jmp 0x8048965 + 0x080488f8 : lea eax,[esp+0x1b8] + 0x080488ff : mov edx,eax + 0x08048901 : mov eax,0x8048d61 + 0x08048906 : mov ecx,0x4 + 0x0804890b : mov esi,edx + 0x0804890d : mov edi,eax + 0x0804890f : repz cmps BYTE PTR ds:[esi],BYTE PTR es:[edi] + 0x08048911 : seta dl + 0x08048914 : setb al + 0x08048917 : mov ecx,edx + 0x08048919 : sub cl,al + 0x0804891b : mov eax,ecx + 0x0804891d : movsx eax,al + 0x08048920 : test eax,eax + 0x08048922 : jne 0x8048939 + 0x08048924 : lea eax,[esp+0x24] + 0x08048928 : mov DWORD PTR [esp],eax + 0x0804892b : call 0x80486d7 + 0x08048930 : mov DWORD PTR [esp+0x1b4],eax + 0x08048937 : jmp 0x8048965 + 0x08048939 : lea eax,[esp+0x1b8] + 0x08048940 : mov edx,eax + 0x08048942 : mov eax,0x8048d66 + 0x08048947 : mov ecx,0x4 + 0x0804894c : mov esi,edx + 0x0804894e : mov edi,eax + 0x08048950 : repz cmps BYTE PTR ds:[esi],BYTE PTR es:[edi] + 0x08048952 : seta dl + 0x08048955 : setb al + 0x08048958 : mov ecx,edx + 0x0804895a : sub cl,al + 0x0804895c : mov eax,ecx + 0x0804895e : movsx eax,al + 0x08048961 : test eax,eax + 0x08048963 : je 0x80489cf + 0x08048965 : cmp DWORD PTR [esp+0x1b4],0x0 + 0x0804896d : je 0x8048989 + 0x0804896f : mov eax,0x8048d6b + 0x08048974 : lea edx,[esp+0x1b8] + 0x0804897b : mov DWORD PTR [esp+0x4],edx + 0x0804897f : mov DWORD PTR [esp],eax + 0x08048982 : call 0x8048470 + 0x08048987 : jmp 0x80489a1 + 0x08048989 : mov eax,0x8048d88 + 0x0804898e : lea edx,[esp+0x1b8] + 0x08048995 : mov DWORD PTR [esp+0x4],edx + 0x08048999 : mov DWORD PTR [esp],eax + 0x0804899c : call 0x8048470 + 0x080489a1 : lea eax,[esp+0x1b8] + 0x080489a8 : mov DWORD PTR [eax],0x0 + 0x080489ae : mov DWORD PTR [eax+0x4],0x0 + 0x080489b5 : mov DWORD PTR [eax+0x8],0x0 + 0x080489bc : mov DWORD PTR [eax+0xc],0x0 + 0x080489c3 : mov DWORD PTR [eax+0x10],0x0 + 0x080489ca : jmp 0x804884f + 0x080489cf : nop + 0x080489d0 : mov eax,0x0 + 0x080489d5 : mov esi,DWORD PTR [esp+0x1cc] + 0x080489dc : xor esi,DWORD PTR gs:0x14 + 0x080489e3 : je 0x80489ea + 0x080489e5 : call 0x80484b0 <__stack_chk_fail@plt> + 0x080489ea : lea esp,[ebp-0xc] + 0x080489ed : pop ebx + 0x080489ee : pop esi + 0x080489ef : pop edi + 0x080489f0 : pop ebp + 0x080489f1 : ret +End of assembler dump. diff --git a/level07/Ressources/pseudo_code.txt b/level07/Ressources/pseudo_code.txt new file mode 100644 index 0000000..9715d19 --- /dev/null +++ b/level07/Ressources/pseudo_code.txt @@ -0,0 +1,12 @@ +|------------|------------|-----------------------------------------------|-------------------------------------------------------------| +| 0x08048... | | asm | pseudo code | +|------------|------------|-----------------------------------------------|-------------------------------------------------------------| +| 723 | 0 | push ebp | stack[esp] == ebp; esp -= 4; eip++; | +| 724 | 1 | mov ebp, esp | ebp = esp; eip += 2; | +| 726 | 3 | push edi | stack[esp] == edi; esp -= 4; eip++; | +| 727 | 4 | push esi | stack[esp] == esi; esp -= 4; eip++; | +| 728 | 5 | push ebx | stack[esp] == ebx; esp -= 4; eip++; | +| 729 | 6 | and esp, 0xfffffff0 | esp -= esp % 16; eip += 3; // aligne la stack a 16 | +| 72c | 9 | sub esp, 0x1d0 | esp -= 464; eip += 6; // alloue 116 ints sur la stack | +| 732 | 15 | mov eax, DWORD PTR [ebp+0xc] | eax = stack[ebp+12] ; eip += 3; // eax choppe l'addr d'argv | + diff --git a/level07/Ressources/register_after_push_ebp b/level07/Ressources/register_after_push_ebp new file mode 100644 index 0000000..c1f2472 --- /dev/null +++ b/level07/Ressources/register_after_push_ebp @@ -0,0 +1,16 @@ +eax 0x8048723 134514467 +ecx 0x1ca531dd 480588253 +edx 0xffffd450 -11184 +ebx 0xf7f9a000 -134635520 +esp 0xffffd428 0xffffd428 +ebp 0xf7ffd020 0xf7ffd020 <_rtld_global> +esi 0xffffd4e4 -11036 +edi 0xf7ffcb80 -134231168 +eip 0x8048724 0x8048724 +eflags 0x246 [ PF ZF IF ] +cs 0x23 35 +ss 0x2b 43 +ds 0x2b 43 +es 0x2b 43 +fs 0x0 0 +gs 0x63 99 diff --git a/level07/Ressources/register_before_push_ebp b/level07/Ressources/register_before_push_ebp new file mode 100644 index 0000000..48ec579 --- /dev/null +++ b/level07/Ressources/register_before_push_ebp @@ -0,0 +1,16 @@ +eax 0x8048723 134514467 +ecx 0x1ca531dd 480588253 +edx 0xffffd450 -11184 +ebx 0xf7f9a000 -134635520 +esp 0xffffd42c 0xffffd42c +ebp 0xf7ffd020 0xf7ffd020 <_rtld_global> +esi 0xffffd4e4 -11036 +edi 0xf7ffcb80 -134231168 +eip 0x8048723 0x8048723
+eflags 0x246 [ PF ZF IF ] +cs 0x23 35 +ss 0x2b 43 +ds 0x2b 43 +es 0x2b 43 +fs 0x0 0 +gs 0x63 99 diff --git a/level07/Ressources/source.c b/level07/Ressources/source.c new file mode 100644 index 0000000..48cc3e4 --- /dev/null +++ b/level07/Ressources/source.c @@ -0,0 +1,145 @@ +int main(int param_1, char **argv, char **envp) + +{ + char cVar1; + int iVar2; + uint uVar3; + undefined4 *puVar4; + char *pcVar5; + byte *pbVar6; + int in_GS_OFFSET; + bool bVar7; + bool bVar8; + bool bVar9; + byte bVar10; + char **local_1c8; + char **local_1c4; + undefined4 storage_service_data_array [100]; + undefined4 local_2c; + undefined4 local_28; + undefined4 local_24; + undefined4 local_20; + undefined4 local_1c; + undefined4 local_18; + int local_14; + + bVar10 = 0; + local_1c4 = param_2; + local_1c8 = param_3; + local_14 = *(int *)(in_GS_OFFSET + 0x14); + local_2c = 0; + local_28 = 0; + local_24 = 0; + local_20 = 0; + local_1c = 0; + local_18 = 0; + puVar4 = storage_service_data_array; + for (int i = 100; i != 0; i--) { + storage_service_data_array[i] = 0; + } + while ( *argv ) + { + memset((void *)*argv, 0, strlen(*argv)); + ++argv; + } + while ( *envp ) + { + memset((void *)*envp, 0, strlen(*envp)); + ++envp; + } + + puts( + "----------------------------------------------------" + "Welcome to wil\'s crappy number stora ge service! " + "----------------------------------------------------" + "Commands: " + " store - store a number into the data storage " + " read - read a number from the data storage " + " quit - exit the program " + "----------------------------------------------------" + " wil has reserved some storage :> " + "----------------------------------------------------" + ); + do { + printf("Input command: "); + local_2c = 1; + fgets((char *)&local_28,0x14,stdin); + uVar3 = 0xffffffff; + puVar4 = &local_28; + do { + if (uVar3 == 0) break; + uVar3 = uVar3 - 1; + cVar1 = *(char *)puVar4; + puVar4 = (undefined4 *)((int)puVar4 + (uint)bVar10 * -2 + 1); + } while (cVar1 != '\0'); + uVar3 = ~uVar3; + bVar7 = uVar3 == 1; + bVar9 = uVar3 == 2; + *(undefined *)((int)&local_2c + uVar3 + 2) = 0; + iVar2 = 5; + puVar4 = &local_28; + pbVar6 = (byte *)"store"; + do { + if (iVar2 == 0) break; + iVar2 = iVar2 + -1; + bVar7 = *(byte *)puVar4 < *pbVar6; + bVar9 = *(byte *)puVar4 == *pbVar6; + puVar4 = (undefined4 *)((int)puVar4 + (uint)bVar10 * -2 + 1); + pbVar6 = pbVar6 + (uint)bVar10 * -2 + 1; + } while (bVar9); + bVar8 = false; + bVar7 = (!bVar7 && !bVar9) == bVar7; + if (bVar7) { + local_2c = store_number(storage_service_data_array); + } + else { + iVar2 = 4; + puVar4 = &local_28; + pbVar6 = &DAT_08048d61; + do { + if (iVar2 == 0) break; + iVar2 = iVar2 + -1; + bVar8 = *(byte *)puVar4 < *pbVar6; + bVar7 = *(byte *)puVar4 == *pbVar6; + puVar4 = (undefined4 *)((int)puVar4 + (uint)bVar10 * -2 + 1); + pbVar6 = pbVar6 + (uint)bVar10 * -2 + 1; + } while (bVar7); + bVar9 = false; + bVar7 = (!bVar8 && !bVar7) == bVar8; + if (bVar7) { + local_2c = read_number(storage_service_data_array); + } + else { + iVar2 = 4; + puVar4 = &local_28; + pbVar6 = &DAT_08048d66; + do { + if (iVar2 == 0) break; + iVar2 = iVar2 + -1; + bVar9 = *(byte *)puVar4 < *pbVar6; + bVar7 = *(byte *)puVar4 == *pbVar6; + puVar4 = (undefined4 *)((int)puVar4 + (uint)bVar10 * -2 + 1); + pbVar6 = pbVar6 + (uint)bVar10 * -2 + 1; + } while (bVar7); + if ((!bVar9 && !bVar7) == bVar9) { + if (local_14 == *(int *)(in_GS_OFFSET + 0x14)) { + return 0; + } + /* WARNING: Subroutine does not return */ + __stack_chk_fail(); + } + } + } + if (local_2c == 0) { + printf(" Completed %s command successfully\n",&local_28); + } + else { + printf(" Failed to do %s command\n",&local_28); + } + local_28 = 0; + local_24 = 0; + local_20 = 0; + local_1c = 0; + local_18 = 0; + } while( true ); +}