Reverse Engineering for CTFs Unit 3:

Overview Homework questions? Java RE Pwntools Stack basics GDB

JAD Java Decompiler Jad is a command line utility for decompiling Java class files. Why can we decompile Java but not C/C++? Java is compiled into Java-bytecode which is then executed by the JVM. The byte code is closer to Java source than assembly is to C source code. Java class files contain metadata, whereas C files do not. To install http://www.javadecompilers.com/jad/Jad%201.5.8e%20for%20Linux%20(statically%20link ed).zip unzip Jad1.5.8eforLinux(statically linked).zip Run: ./jad file.class

Sample Java Code

Java Bytecode

pwntools pwntools is a CTF framework and exploit development library. Written in Python. Designed for rapid prototyping and development intended to make exploit writing as simple as possible Follow the instructions at https://docs.pwntools.com/en/stable/install.html to install. Documentation at https://docs.pwntools.com/en/stable/.

pwntools

32 Bit Stack Example

32 Bit Stack Example Each stack entry is 4 bytes (32 bits) Function arguments are pushed on the stack from right to left. The return address is pushed after the arguments. The function prologue of foo then saves the ebp and adjusts esp to allow room for local variables. EBP minus a value = local variable EBP plus a value = arguments

64 Bit Stack Example

64 Bit Stack Example

64 Bit Stack Example Each stack entry is 8 bytes (64 bits) Arguments are passed right to left using registers, until the RDI, RSI, RDX, RCX, R*, and R9 registers are used. Once all 6 of the mentioned registers have been used, any remaining arguments are passed left to right by pushing them on the stack. Function prologue saves rbp and adjusts rsp to create room for local variables.

GDB: print value at [ebp-0xff] x/xw (int*)($ebp +/- 0xHexValue) x = Examine memory /xw = Examine hex value of 1 word size (4 bytes) (int*) Cast value to an integer ($ebp +/- 0xHexValue) = The address to examine Note: this could also be ($esp +/- 0xHexValue) or any address on the stack.

GDP: Print string at an address x/100s ADDRESS X = Examine memory /100 = Length to be examined s = Examine string ADDRESS = Hex address to be examined

GDB: context Use the ‘context’ command to reopen pwndbg’s or peda’s context display.