Root-Me: ELF C++ - 0 protection solution
Hello!
My daily work is doing full stack web development, and reversing is a side thing that I do for fun and in my free time. In this article I will show you an easy way to solve for ELF C++ - 0 protection challenge, which can be found on https://www.root-me.org under the cracking section.
I found this challenge a bit difficult mostly because I'm not used to reverse C++ code but, since it doesn't contain any protection at all, all you need to do is to inspect the parameters.
If we play with the binary a little, maybe visualize it in https://ghidra-sre.org/, we can see that plouf is an interesting function and it's definitely doing something, like decoding something from the binary and constructing a string.
If we fire gdb and run the program, we can setup a breakpoint right after plouf and inspect the returned value.
gdb ch25.bin
r 123
b *0x08048b51
>>> x/10x $eax
0xbffff664: 0x1c 0xc1 0x04 0x08 0x2c 0xc0 0x04 0x08
0xbffff66c: 0x14 0xc0
This doesn't tell us much, but if you look closely you can see that it points to: 0x1c 0xc1 0x04 0x08
Which is an address: 0x0804c11c it is written that way because of endianness. Inspecting the value of the address in GDB will give us the output that plouf spits.
PS: Things get even more easier if you're using GDB Peda.
Resources:
https://www.digital-detective.net/understanding-big-and-little-endian-byte-order/
https://archive.org/details/2007_BlackHat_Vegas-V72-Yason-Sabanal-Reversing_C
Thanks for reading!