Skip to main content

Posts

Crackmes: cli3nt’s mycrk

Language C Linux x86/ELF Difficulty: 1 - Very easy, for newbies Platform: Unix/Linux, etc. Language: C/C++ [Solving the Crackme] As usual, we have to run the file first. joset@kee:~/src/crackmes/mycrk$ ./mycrk Type cd-key: eve wrong! joset@kee:~/src/crackmes/mycrk$ From this point we already know what the file needs, a correct key . I immediately disassembled the file without even bothering about its characteristics. joset@kee:~/src/crackmes/mycrk$ objdump -d mycrk > temp.txt joset@kee:~/src/crackmes/mycrk$ less temp.txt The first trick, is to look for the disassembly of the main function. Here’s a portion of it. ... 80483d4: c7 45 fc 67 1e 01 00 movl $0x11e67,0xfffffffc(%ebp) 80483db: c7 45 f8 70 12 5b 00 movl $0x5b1270,0xfffffff8(%ebp) 80483e2: c7 45 f0 06 00 00 00 movl $0x6,0xfffffff0(%ebp) 80483e9: 83 ec 0c sub $0xc,%esp 80483ec: 68 14 85 04 08 push $0x8048514 80483f1: e8 ee f...

A palindrome checker in 16-bit DOS assembly

A good morning to start off is to get this simple program working. This is an improvement of the previous palindrome checker posted. What can we benefit from this anyway? ; palindrome checker start: mov ah, 0ah lea dx, strptr int 21h lea di, string lea si, strlen mov cl, [si] xor ch, ch mov bx, cx lea si, string shr cl, 1 check: mov dl, [si] mov dh, [di+bx-1] cmp dl, dh jne notpal inc si dec di loop check cmp dl, dh je pal notpal: mov ah, 09h lea dx, msg2 int 21h int 20h pal: mov ah, 09h lea dx, msg1 int 21h int 20h strptr label byte maxlen db 49 strlen db ? string db 50 dup ('$') msg1 db '',10,'string is a palindrome!$' msg2 db '',10,'string is not a palindrome!$' “If God’s people which are call...

A case inverter in 16-bit DOS assembly

This is a simple case inverter, if you want to try this out download the a86 assembler here . It works like a charm in dosemu-freedos . ; case inverter start: mov ah, 0ah lea dx, strptr int 21h lea si, string mov cl, [strlen] check: mov al, [si] cmp al, 'Z' ja lowercase cmp al, 'a' jb uppercase lowercase: cmp al, 'a' jb traverse cmp al, 'z' jbe toupper uppercase: cmp al, 'Z' ja traverse cmp al, 'A' jae tolower toupper: sub al, 32 mov [si], al jmp traverse tolower: add al, 32 mov [si], al traverse: inc si loop check mov ah, 02h mov dl, 10 int 21h mov ah, 09h lea dx, string int 21h int 20h strptr label byte maxlen db 49 strlen db ? string db 50 dup ('$') “Fo...

Crackmes: lord’s easy Linux crackme

crackme will print text under certain conditions what are the conditions? sorry for my bad english - lord Difficulty: 1 - very easy, for newbies Platform: Unix/Linux, etc. Language: Assembler [Solving the Crackme] An initiative would be running the file: joset@kee:~/src/crackmes$ ./blah joset@kee:~/src/crackmes$ It didn’t print anything at all. So the conditions aren’t met. I’ve been using gdb and objdump for quite some time now. Since there is no form of corruption in the file, these tools will be more than enough. Here’s the disassembly of the file in objdump: blah: file format elf32-i386 Disassembly of section .text: 08048094 : 8048094: 31 c0 xor %eax,%eax 8048096: b8 2f 00 00 00 mov $0x2f,%eax 804809b: cd 80 int $0x80 804809d: 3d ad de 00 00 cmp $0xdead,%eax 80480a2: 75 16 jne 0x80480ba 80480a4: b8 04 00 00 ...

Making you feel loved was the easiest thing I have ever done before. It’s just sad to think that things just changed. I wish I could turn back those days. The times when we sat down under a tree, observed the fading horizon, held hands and stared at the crimsoning sun. I know how destiny fools us. If destiny asserts that we are not for each other, then I would fight destiny just to have you in my arms forever. I love you my everdearest. I’m sorry for what had happened to the rose. It’s not too late though, I can still take care another bud for you.

Antidote for insanity

Simple programming stuffs save me from insanity. This a86 assembly program tells if str1 is a palindrome. start: cld mov cx, 7 lea si, str1 lea di, temp reverse: mov al, [si+6] mov [di], al inc di dec si loop reverse mov ah, 09h lea dx, temp int 21h cld mov cx, 4 compare: lea di, temp lea si, str1 repe cmpsb jne exit mov ah, 09h lea dx, yes int 21h exit: mov ah, 4Ch mov al, 00 int 21h int 20h str1 db 'racecar$' yes db '',10,'string is a palindrome!$' temp db 8 dup ('$') [Middle-East Crisis] Israel, known as the chosen people of God called a thousand reservists in a possible prelude to a ground offensive against Lebanon. Accordingly, they have to clean up bunkers and tunnels that are invulnerable to air attacks. Isn’t it ironic...

Outdoorsman recall

I can still remember way back then, I was five years old when I had my primary hobbies, hunting, fishing, and shooting-range. Today, we went to Sinubung, a semi-dangerous place located in the far west coast of Zamboanga City and is known for its shore having huge waves and numerous sea urchins. We have gone fishing. It was fun riding my grandfather’s motor-operated vinta again though I am deeply saddened with what had happened today. The last time I set foot on that vinta was 15 years ago. I can still remember my grandfather pulling the nylon with a huge squid hooked up. Of course, the squid fired up a black tint. Because of that black tint, and the times when I threw up while riding the vinta, I have something now which I call memories worth remembering. Awhile ago, we did the same but no squid and from what I have observed fishes are already scarce! We spent almost three hours, changing position from time to time on the sea. I was the one throwing and pulling the anchor everyt...

Preparing for Muziklaban

Red Horse Muziklaban is fast approaching. Tomorrow will be the qualification or shall I say audition. One composition down. I am still trying to come up with a nice riff for the adlib. Hoping to impress the judges tomorrow. [Programming] I am just messing up with DOS Assembly. I started out programming in 32-bit protected mode, now broadening my knowledge by diving into 16-bit real mode. I have nothing new these days, just reviewing C++. Signing off through a quote by Albert Einstein “Information is not knowledge.”

Victory!

Congratulations Manny Pacquiao! He was once a singer of a local band in Gen. Santos City. Look at him now, he is the most influential person in our nation and probably one of the most influential persons around the globe. I was really fascinated by his fight with Oscar Larios. He has become faster than ever. Incomparable vigor that is! Raise it up Manny. More power and advertisements ahead. On the other hand, I pity Oscar Larios, he was a great fighter. I admire his sportsmanship and humility. He is one of the cheerful and honest boxers I’ve ever seen. His courage is a deadly weapon that one shouldn’t take advantage of. Maintaining his mind in equilibrium state could have driven Manny on the floor. [Globe Telecom] What is happening? I couldn’t send and receive SMSs. Calling does not solve the issue either. Hoping for better services in the future.

GDT Explained

GDT contains a number of entries, Segment Descriptors . Usually each is 8 bytes long and marks the starting point, length, and access rights of the segment. It is stored in memory of course. The address is stored in a special 48-bit CPU register called Global Descriptor Table Register (GDTR). The lower 16 bits inform the size of the GDT while the upper 32 bits inform the location of the GDT in memory. The GDT itself is a 64-bit long entries. These entries define whether the current segment that the processor is running is for Ring 0 or Ring 3. Ring levels are restrictions, Ring 0 is for system use while Ring 3 is for application use. Such protection exists to prevent applications from causing the kernel to crash and to tell the processor which instructions are valid. –snipped–

Orders received!

ADZU Open Lab will be switching to Edubuntu 6.06 Dapper Drake! Wee! Expecting Ubuntu sovereignty in the University! More power Ubuntu Linux Development Team. A Freedom Toaster empowered by Shuttleworth Foundation is badly needed in our University. The network administrator, Sir Greg, also suggested Xubuntu 6.06 in the College Internet Access Area (CIAA). Well, it’s easy as one-two-three.

I’m back!

It’s good to be back to one’s abode. I haven’t been blogging lately for the reason that my dad was confined and there were no other who could watch over him except me. Good thing that my dad’s okay now. Got to go, have to finish the enrollment process. God bless.

20!

Twenty factorial? Thank God for all the blessings especially the gift of life. Thank you mom and dad for taking care of me. Thank you everyone! Happy birthday to me! I am no longer a teenage lad. I could not believe it. Time flies so fast.

Revamp, an apology

[Previous Post] Sorry I forgot the private flag because I was in a hurry awhile ago. I hope it didn’t deface Planet Ubuntu-PH. [OS Development] Global Descriptor Table conquered! Nothing special, more tasks ahead. So far so good. Linux 0.01 is cool and MiniOS (Minix) too! Hail to you Linus Torvalds and Andrew Tanenbaum.

Jeepney, today - 2

Thinking of the song? No, definitely not Kala’s hit in the Myx Daily Top 10. It was 31 down 7 o’clock in the evening, the last day of our training. The sky was darkening and the wind blew softly as I walked toward the terminal. Going home later than 6 o’clock in the evening is such a waste of time I heard myself whisper. Before taking the jeepney in line, I have decided to sit down and buy a bottle of coke in a bakery situated near the end of the terminal. While taking a sip, I observed people passing by. Definitely not Manila, whispering to myself and reminiscing the events a year ago. 5 minutes would be long enough for me to begin sipping air so I took a jeepney. I have waited for the jeepney to be filled up. Not exceeding 10 minutes, the wheels started rolling as expected. This year is going to be the hardest school year ever. Again, talking to myself. Anticipating sleepless nights, hardworks, additional duties or obligations, etc. Then suddenly while thinking o...