« first day (2330 days earlier)      last day (527 days later) » 

4:21 PM
Purely for autodidactical purpose:
Assume you have the following code snippet
#include <string.h>
#include <stdio.h>

int main(int argc, char *argv[]) {
        if(argc==2) {
		printf("Checking License: %s\n", argv[1]);
		if(strcmp(argv[1], "AAAA-Z10N-42-OK")==0) {
			printf("Access Granted!\n");
		} else {
			printf("WRONG!\n");
		}
	} else {
		printf("Usage: <key>\n");
	}
	return 0;
}
One could run this binary with gdb break at strcmp and overwrite the result of this function call.
if both strings are equal on an x86_64 machine you'd have 0x00 in the rax/eax register
so even if you would do: $./thisApp SOME-RANDOM-KEY by writing 0 to the rax register at the correct moment the application would print "Access Granted!"
With gdb this can easily be done, by stepping through the code and doing this manually. Is there a way to somehow do this automatically?
I thought about maybe using LD_PRELOAD and overwriting the strcmp function from glibc, so that it always returns 0.
But was wondering whether there are other automated ways to proceed here? Some ways that do not require to preload something for instance and do not require me to set eax manually via gdb
 
nwp
5:07 PM
gdb has a Python interface you can use for scripting.
You could also patch the binary and replace the je with a jne which conveniently have the same size.
Also popular is overwriting that section with a bunch of nops.
 
5:42 PM
@nwp this requires the target to have gdb. Which in my hypothetical case is not true
(embedded stuff)
 
nwp
We have gdb working on embedded stuff just fine. You can probably buy a JTag debugger and get it to work.
If you don't then you probably can't overwrite the binary either.
 
 
1 hour later…
7:08 PM
@nwp some embedded devices are baremetal
I was more thinking about that kind
 
nwp
You can use gdb on baremetal just fine.
But doesn't matter, if you don't have it you can't use it.
 
you're right it is indeed possible on baremetal stuff as well. My bad
This makes me think that actually one very big hurdle one might face
is to be able to somehow extract the binary from the device.
Being able to extract it would allow you to run it inside an emulator on your PC and play around as much as you want
 

« first day (2330 days earlier)      last day (527 days later) »