我正在尝试破解破解版。我已经抓住了标志,因为我看到了代表标志的字符串变量。我想以另一种方式捕获标志,我想在比较字符串时设置断点。我想使用radare2。
当我使用dc命令运行应该停止到我设置的断点的程序时,我收到消息TO DO continue。我不知道为什么。我希望收到以下形式的消息:
string 1 : TheStringIEnter string 2 : TheFlagOfTheChallenge
这是我执行的命令:
radare 2 -d ch1.bin
s sym.main
aaa
pdf
VV
:
:> db 0x08048705
:> dc
TODO continue
:>
这是 pdf 命令的输出:
[0x0804869d]> pdf
/ (fcn) main 155
| main (int argc, char **argv, char **envp);
| ; var int local_ch @ ebp-0xc
| ; var int local_8h @ ebp-0x8
| ; var int local_4h @ esp+0x4
| ; DATA XREF from entry0 (0x8048507)
| 0x0804869d 8d4c2404 lea ecx, [local_4h] ; 4
| 0x080486a1 83e4f0 and esp, 0xfffffff0
| 0x080486a4 ff71fc push dword [ecx - 4]
| 0x080486a7 55 push ebp
| 0x080486a8 89e5 mov ebp, esp
| 0x080486aa 51 push ecx
| 0x080486ab 83ec24 sub esp, 0x24 ; '$'
| 0x080486ae c745f8418804. mov dword [local_8h], str.123456789 ; 0x8048841 ; "123456789"
| 0x080486b5 c704244c8804. mov dword [esp], str. ; [0x804884c:4]=0x23232323 ; "############################################################"
| 0x080486bc e807feffff call sym.imp.puts ; int puts(const char *s)
| 0x080486c1 c704248c8804. mov dword [esp], str.welcome_to_challenge ; [0x804888c:4]=0x20202323 ; "## Welcome to this challenge ##"
| 0x080486c8 e8fbfdffff call sym.imp.puts ; int puts(const char *s)
| 0x080486cd c70424cc8804. mov dword [esp], str. ; [0x80488cc:4]=0x23232323 ; "############################################################\n"
| 0x080486d4 e8effdffff call sym.imp.puts ; int puts(const char *s)
| 0x080486d9 c704240c8904. mov dword [esp], str.please_enter_pass: ; [0x804890c:4]=0x69756556 ; "Please enter the password : "
| 0x080486e0 e8b3fdffff call sym.imp.printf ; int printf(const char *format)
| 0x080486e5 8b45f4 mov eax, dword [local_ch]
| 0x080486e8 890424 mov dword [esp], eax
| 0x080486eb e80effffff call sym.getString
| 0x080486f0 8945f4 mov dword [local_ch], eax
| 0x080486f3 8b45f8 mov eax, dword [local_8h]
| 0x080486f6 89442404 mov dword [local_4h], eax
| 0x080486fa 8b45f4 mov eax, dword [local_ch]
| 0x080486fd 890424 mov dword [esp], eax
| 0x08048700 e8d3fdffff call sym.imp.strcmp ; int strcmp(const char *s1, const char *s2)
| 0x08048705 85c0 test eax, eax
| ,=< 0x08048707 7515 jne 0x804871e
| | 0x08048709 8b45f8 mov eax, dword [local_8h]
| | 0x0804870c 89442404 mov dword [local_4h], eax
| | 0x08048710 c70424308904. mov dword [esp], str.good_job:__s ; [0x8048930:4]=0x6e656942 ; "Good job ! You just pass the challenge with the pass : %s!\n"
| | 0x08048717 e87cfdffff call sym.imp.printf ; int printf(const char *format)
| ,==< 0x0804871c eb0c jmp 0x804872a
| || ; CODE XREF from main (0x8048707)
| |`-> 0x0804871e c70424708904. mov dword [esp], str.bad__password. ; [0x8048970:4]=0x6d6d6f44 ; "Bad password."
| | 0x08048725 e89efdffff call sym.imp.puts ; int puts(const char *s)
| | ; CODE XREF from main (0x804871c)
| `--> 0x0804872a b800000000 mov eax, 0
| 0x0804872f 83c424 add esp, 0x24 ; '$'
| 0x08048732 59 pop ecx
| 0x08048733 5d pop ebp
| 0x08048734 8d61fc lea esp, [ecx - 4]
\ 0x08048737 c3 ret
[0x0804869d]>