OUTLINE 2 Pre-requisite Bomb!

Pre-requisite Bomb! 3

GNU Tools  GDB (Gnu DeBugger)  Start your program  Stop on special conditions  Exams what has happened  Change thing in your program 4

GNU Tools  GDB (Gnu DeBugger)  Commands  gdb  break FUNC | *ADDR  run  print $REG | ADDR  continue | stepi | nexti  quit 5 Reference

GNU Tools  OBJDUMP (OBJect-file DUMP)  Display information from object files  Disassemble object file  Show file headers  Show symbol table ...  Commands  objdump –d | -D 6

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

GNU Tools  Install GNU Tools  apt-get install build-essential  apt-get install gdb 8

Pre-requisite Bomb!  Binary Bomb Defuse Bomb Using GDB 9

Bomb Defuse Bomb  What is Bomb ?  Only a binary file  What should you do ?  Find the key and defuse the bomb !  What can you use ?  Anything from ICS course  Any tools Right key Survive Wrong key Bomb ! gdb strings calculator pencilpaper objdump

 Please See Carefully !  A binary bomb  Need a password to defuse it  Demo $./bomb key: bomb!!! :( $ $./bomb input password: Survive :) Demo

Pre-requisite Bomb! Binary Bomb  Defuse Bomb Using GDB 13

Step by Step  Machine Code to Assembly Code  objdump -D bomb > asm NAME objdump - display information from object files. objdump - display information from object files.SYNOPSIS objdump [-d|--disassemble] objdump [-d|--disassemble] [-D|--disassemble-all] [-D|--disassemble-all]......

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

Step by Step  Find key functions and parameters  scanf:  scanf: where does the password store ?  printf:  printf: which the instruction will print “bomb” ?

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

Step by Step  Find key functions and parameters  scanf:  scanf: where does the password store ?  printf:  printf: which the instruction will print “bomb” ?  Find key strings bombsurvivekey  “ bomb ”, “ survive ” and “ key ”

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

b4:4b b7:3a 00 cmp (%eax),%al 80485b9: …… 80485be: c0: a c7: c8:6f 80485c9:6d 80485ca: cc: ce:20 3a 80485d0: yeK Su rv i ve B o m b

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl $0x80485b4,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl $0x80485bc,(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl $0x80485c7,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl Key,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl survive :),(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl bomb!!! :(,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

Step by Step  Find key functions and parameters  scanf:  scanf: where does the password store ?  printf:  printf: which the instruction will print “bomb” ?  Find key strings bombsurvivekey  “ bomb ”, “ survive ” and “ key ”  Find key operators  jmp  jmp, change control flow  cmp  cmp, how to judgment condition

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl Key,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl survive :),(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl bomb!!! :(,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl Key,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl survive :),(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl bomb!!! :(,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl Key,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl survive :),(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl bomb!!! :(,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret Key

Pre-requisite Bomb! Binary Bomb Defuse Bomb  Using GDB 32

 Defuse bomb using GDB  set breakpoint on the critical path  watch registers and/or memories  terminate program on demand  single step execution Can we do it more efficiently and safely?

Command  GDB  gdb  break FUNC | *ADDR  run  print $REG | ADDR  continue | stepi | nexti  quit

c : c:55 push %ebp d:89 e5 mov %esp,%ebp f:83 e4 f0 and $0xfffffff0,%esp 80484a2:83 ec 20 sub $0x20,%esp 80484a5:c movl $0x ,(%esp) 80484ac:e8 af fe ff ff call b1:c b movl Key,(%esp) 80484b8:e8 93 fe ff ff call bd:8d c lea 0x1c(%esp),%eax 80484c1: mov %eax,0x4(%esp) 80484c5:c b movl $0x80485b9,(%esp) 80484cc:e8 bf fe ff ff call d1:8b c mov 0x1c(%esp),%eax 80484d5:83 f8 6c cmp $0x6c,%eax 80484d8:75 0e jne 80484e da:c bc movl survive :),(%esp) 80484e1:e8 7a fe ff ff call e6:eb 0c jmp 80484f e8:c c movl bomb!!! :(,(%esp) 80484ef:e8 6c fe ff ff call f4:c9 leave 80484f5:c3 ret

$gdb mini-bomb (gdb)

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) 0x80484b8 “key”

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) break *0x80484d5 Breakpoint 2 at 0x80484d5 (gdb) 0x80484b8 “password” 0x80484d5 “compare”

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) break *0x80484d5 Breakpoint 2 at 0x80484d5 (gdb) break *0x80484da Breakpoint 3 at 0x80484da (gdb) 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive”

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) break *0x80484d5 Breakpoint 2 at 0x80484d5 (gdb) break *0x80484da Breakpoint 3 at 0x80484da (gdb) break *0x80484e8 Breakpoint 4 at 0x80484e8 (gdb) 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) break *0x80484d5 Breakpoint 2 at 0x80484d5 (gdb) break *0x80484da Breakpoint 3 at 0x80484da (gdb) break *0x80484e8 Breakpoint 4 at 0x80484e8 (gdb) run Starting program: /home/ics-15/lab2/bomb Breakpoint 1, 0x080484b8 in main () (gdb) 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) break *0x80484d5 Breakpoint 2 at 0x80484d5 (gdb) break *0x80484da Breakpoint 3 at 0x80484da (gdb) break *0x80484e8 Breakpoint 4 at 0x80484e8 (gdb) run Starting program: /home/ics-15/lab2/bomb Breakpoint 1, 0x080484b8 in main () (gdb) print/c *0x80485b4 $1 = 75 ‘K' (gdb) 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) break *0x80484d5 Breakpoint 2 at 0x80484d5 (gdb) break *0x80484da Breakpoint 3 at 0x80484da (gdb) break *0x80484e8 Breakpoint 4 at 0x80484e8 (gdb) run Starting program: /home/ics-15/lab2/bomb Breakpoint 1, 0x080484b8 in main () (gdb) print/c *0x80485b4 $1 = 75 ‘K' (gdb) print/c *0x80485b5 $2 = 101 ‘e' (gdb) 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

$gdb mini-bomb (gdb) break *0x80484b8 Breakpoint 1 at 0x80484b8 (gdb) break *0x80484d5 Breakpoint 2 at 0x80484d5 (gdb) break *0x80484da Breakpoint 3 at 0x80484da (gdb) break *0x80484e8 Breakpoint 4 at 0x80484e8 (gdb) run Starting program: /home/ics-15/lab2/bomb Breakpoint 1, 0x080484b8 in main () (gdb) print/c *0x80485b4 $1 = 75 ‘K' (gdb) print/c *0x80485b5 $2 = 101 ‘e' (gdb) print/s (char *)0x80485b4 $3 = 0x80485b4 "Key:" 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

(gdb) c Continuing. Key: 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

(gdb) c Continuing. Key:224 Breakpoint 2, 0x080484d5 in main () (gdb) 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

(gdb) c Continuing. Key:224 Breakpoint 2, 0x080484d5 in main () (gdb)print/d $eax $8 = 224 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

(gdb) c Continuing. Key:224 Breakpoint 2, 0x080484d5 in main () (gdb)print/d $eax $8 = 224 (gdb) c Continuing. Breakpoint 4, 0x080484e8 in main () (gdb) 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

(gdb) c Continuing. Key:224 Breakpoint 2, 0x080484d5 in main () (gdb)print/d $eax $8 = 224 (gdb) c Continuing. Breakpoint 4, 0x080484e8 in main () (gdb)q The program is running. Exit anyway? (y or n) y $ 0x80484b8 “password” 0x80484d5 “compare” 0x80484da “survive” 0x80484e8 “bomb”

50