Tags: binary hex
Rating:
Description:
Well I just loaded,
and this is crazy,
but here's my address,
172.31.0.10/artisinal_assembly_0331fb4526b5ffee34f6ab66899bac0b
Running objdump on the binary showed minimal obfuscation, as well as a `main` function that seemed to do nothing more than call a bunch of functions:
0000000000400506 <main>:
400506: 55 push %rbp
400507: 48 89 e5 mov %rsp,%rbp
40050a: b8 00 00 00 00 mov $0x0,%eax
40050f: e8 63 01 00 00 callq 400677 <initialize_dx>
400514: b8 00 00 00 00 mov $0x0,%eax
400519: e8 61 01 00 00 callq 40067f <import_input>
40051e: b8 00 00 00 00 mov $0x0,%eax
400523: e8 6c 01 00 00 callq 400694 <a_good_start>
400528: b8 00 00 00 00 mov $0x0,%eax
40052d: e8 31 01 00 00 callq 400663 <word_realignment>
400532: b8 00 00 00 00 mov $0x0,%eax
400537: e8 71 00 00 00 callq 4005ad <source_cx>
40053c: b8 00 00 00 00 mov $0x0,%eax
400541: e8 5f 01 00 00 callq 4006a5 <todo_unit_tests>
400546: b8 00 00 00 00 mov $0x0,%eax
40054b: e8 4d 01 00 00 callq 40069d <largerify>
400550: b8 00 00 00 00 mov $0x0,%eax
400555: e8 33 01 00 00 callq 40068d <timing_offset>
40055a: b8 00 00 00 00 mov $0x0,%eax
40055f: e8 5f 00 00 00 callq 4005c3 <finalize_xc>
400564: b8 00 00 00 00 mov $0x0,%eax
400569: e8 4d 00 00 00 callq 4005bb <almost_there>
40056e: b8 00 00 00 00 mov $0x0,%eax
400573: e8 61 00 00 00 callq 4005d9 <todo_reexamine>
400578: b8 00 00 00 00 mov $0x0,%eax
40057d: e8 79 00 00 00 callq 4005fb <reticulate_splines>
400582: b8 00 00 00 00 mov $0x0,%eax
400587: e8 42 00 00 00 callq 4005ce <timing_loop>
40058c: b8 00 00 00 00 mov $0x0,%eax
400591: e8 65 00 00 00 callq 4005fb <reticulate_splines>
400596: b8 00 00 00 00 mov $0x0,%eax
40059b: e8 3f 00 00 00 callq 4005df <export_results>
4005a0: 5d pop %rbp
4005a1: c3 retq
Ignoring `mov %0x0,%eax`, we notice that function calls appear out of order from the function definitions, as well as `important_initialization`, which wasn't called at all:
00000000004005a2 <important_initialization>:
00000000004005ad <source_cx>:
00000000004005bb <almost_there>:
00000000004005c3 <finalize_xc>:
00000000004005ce <timing_loop>:
00000000004005d9 <todo_reexamine>:
00000000004005df <export_results>:
00000000004005fb <reticulate_splines>:
0000000000400663 <word_realignment>:
0000000000400677 <initialize_dx>:
000000000040067f <import_input>:
000000000040068d <timing_offset>:
0000000000400694 <a_good_start>:
000000000040069d <largerify>:
00000000004006a5 <todo_unit_tests>:
Stepping through the instructions reveals nothing, as the program just builds the string "The answer is 42" and prints it.
Initially we thought that execution order was important, and that maybe we needed to call all the functions in the order defined in the binary, but it didn't seem like there was enough code, nor available static strings, to produce anythinge else. Additionally, the NOPs spread through the program strongly suggested that the function offsets were important.
By taking the least significant byte of each instruction argument in `main` we get:
89 63 61 6c 31 71 5f 4d 33 5f 4d 61 79 42 65 3f
which can be converted back from hex to get:
$ echo -n '89 63 61 6c 31 71 5f 4d 33 5f 4d 61 79 42 65 3f' | xxd -r
cal1q_M3_MayBe?
Answer:
cal1q_M3_MayBe?