May 11, 2021

Crack executables with gdb?

Home Forums Crack executables with gdb?

This topic contains 1 reply, has 2 voices, and was last updated by  NetflixMemes 1 month ago.

  • Author
    Posts
  • #382069

    anonymous
    Participant

    Hi, I’m a beginner in hacking and I have some Linux executables(Elf) from which I have to extract some data, the first one use several system sleeps and very long loops to avoid this data print, the data Is generated procedurally so I cannot just search, find and decode It in the binaries, so my first question Is, Is It possible to use gdb to skip sleeps and loops and how can I do It?
    The second executable gets an input and does some operations on It, when I try to reach the part of code that I’d like to execute I get segmentation fault error, It seems that the code was written to have this error on purpose. Reading the assembly code I found that segmentation fault is generated on some variables copy in or from DWORD PTR and BYTE PTR, I’ve also noticed that most of the times the pointers point to nothing(0x000…), In this case what should I do to get over this error and execute the code I want?
    Note that I don’t have debug symbols and source codes, just the elfs, both doesn’t have canaries + I have installed gef to have some additional help.

  • #382070

    NetflixMemes

    You could simplify your life by using Ghidra (free NSA reverse engineering tool).
    Frida might be a good tool to look into as well. It allows you to hook function calls in a given process so you could use it to nop the sleeps you’re talking about.
    nm is another tool you can use to simply get the methods in the binary.

    The null pointers are probably just pre-initialized variables that get used in the loop, the crash is probably preventing you from getting to the branch responsible for using them.

    Good luck, and welcome to reverse engineering!

  • #382071

    MrKhutz

    I second the use of Ghidra.

    In gdb the ‘jump’ command might be what you want to skip to the execution of hard to access code. Without debug info (no line numbers) you need to use the address which I think would be ‘jump *0x0000576ae’ for example….

  • #382072

    DRusTheBus

    I can’t answer all of your questions, but with gdb you can set breakpoints to stop execution. You can either step through the code line by line or jump to specific points in the program/memory. I haven’t done this in years, but hopefully that’s enough of a start for you.

    Edit: depending on the type of file you have, you might be able to edit it to skip some sections. If there’s a loop with a break if ==1,000,000, you might be able to edit it to say break if !=1,000,000

You must be logged in to reply to this topic.