InCTF 2014 - Reverse 100

Hi this is my first reverse engineering with GDB. Challenge was to get the flag from the display_function. First we should disassemble the executable file with objdump to see how the program control works. 
root@Vijay:~/Desktop/inctf 14/reverse# objdump -d four

four:     file format elf32-i386


Disassembly of section .init:

080482f4 <_init>:
 80482f4:	53                   	push   %ebx
 80482f5:	83 ec 08             	sub    $0x8,%esp
 80482f8:	e8 b3 00 00 00       	call   80483b0 <__x86.get_pc_thunk.bx>
 80482fd:	81 c3 03 1d 00 00    	add    $0x1d03,%ebx
 8048303:	8b 83 fc ff ff ff    	mov    -0x4(%ebx),%eax
 8048309:	85 c0                	test   %eax,%eax
 804830b:	74 05                	je     8048312 <_init+0x1e>
 804830d:	e8 3e 00 00 00       	call   8048350 <__gmon_start__@plt>
 8048312:	83 c4 08             	add    $0x8,%esp
 8048315:	5b                   	pop    %ebx
 8048316:	c3                   	ret    

Disassembly of section .plt:

08048320 :
 8048320:	ff 35 04 a0 04 08    	pushl  0x804a004
 8048326:	ff 25 08 a0 04 08    	jmp    *0x804a008
 804832c:	00 00                	add    %al,(%eax)
	...

08048330 :
 8048330:	ff 25 0c a0 04 08    	jmp    *0x804a00c
 8048336:	68 00 00 00 00       	push   $0x0
 804833b:	e9 e0 ff ff ff       	jmp    8048320 <_init+0x2c>

08048340 :
 8048340:	ff 25 10 a0 04 08    	jmp    *0x804a010
 8048346:	68 08 00 00 00       	push   $0x8
 804834b:	e9 d0 ff ff ff       	jmp    8048320 <_init+0x2c>

08048350 <__gmon_start__@plt>:
 8048350:	ff 25 14 a0 04 08    	jmp    *0x804a014
 8048356:	68 10 00 00 00       	push   $0x10
 804835b:	e9 c0 ff ff ff       	jmp    8048320 <_init+0x2c>

08048360 <__libc_start_main@plt>:
 8048360:	ff 25 18 a0 04 08    	jmp    *0x804a018
 8048366:	68 18 00 00 00       	push   $0x18
 804836b:	e9 b0 ff ff ff       	jmp    8048320 <_init+0x2c>

08048370 :
 8048370:	ff 25 1c a0 04 08    	jmp    *0x804a01c
 8048376:	68 20 00 00 00       	push   $0x20
 804837b:	e9 a0 ff ff ff       	jmp    8048320 <_init+0x2c>

Disassembly of section .text:

08048380 <_start>:
 8048380:	31 ed                	xor    %ebp,%ebp
 8048382:	5e                   	pop    %esi
 8048383:	89 e1                	mov    %esp,%ecx
 8048385:	83 e4 f0             	and    $0xfffffff0,%esp
 8048388:	50                   	push   %eax
 8048389:	54                   	push   %esp
 804838a:	52                   	push   %edx
 804838b:	68 40 86 04 08       	push   $0x8048640
 8048390:	68 d0 85 04 08       	push   $0x80485d0
 8048395:	51                   	push   %ecx
 8048396:	56                   	push   %esi
 8048397:	68 6c 85 04 08       	push   $0x804856c
 804839c:	e8 bf ff ff ff       	call   8048360 <__libc_start_main@plt>
 80483a1:	f4                   	hlt    
 80483a2:	66 90                	xchg   %ax,%ax
 80483a4:	66 90                	xchg   %ax,%ax
 80483a6:	66 90                	xchg   %ax,%ax
 80483a8:	66 90                	xchg   %ax,%ax
 80483aa:	66 90                	xchg   %ax,%ax
 80483ac:	66 90                	xchg   %ax,%ax
 80483ae:	66 90                	xchg   %ax,%ax

080483b0 <__x86.get_pc_thunk.bx>:
 80483b0:	8b 1c 24             	mov    (%esp),%ebx
 80483b3:	c3                   	ret    
 80483b4:	66 90                	xchg   %ax,%ax
 80483b6:	66 90                	xchg   %ax,%ax
 80483b8:	66 90                	xchg   %ax,%ax
 80483ba:	66 90                	xchg   %ax,%ax
 80483bc:	66 90                	xchg   %ax,%ax
 80483be:	66 90                	xchg   %ax,%ax

080483c0 :
 80483c0:	b8 2b a0 04 08       	mov    $0x804a02b,%eax
 80483c5:	2d 28 a0 04 08       	sub    $0x804a028,%eax
 80483ca:	83 f8 06             	cmp    $0x6,%eax
 80483cd:	77 01                	ja     80483d0 
 80483cf:	c3                   	ret    
 80483d0:	b8 00 00 00 00       	mov    $0x0,%eax
 80483d5:	85 c0                	test   %eax,%eax
 80483d7:	74 f6                	je     80483cf 
 80483d9:	55                   	push   %ebp
 80483da:	89 e5                	mov    %esp,%ebp
 80483dc:	83 ec 18             	sub    $0x18,%esp
 80483df:	c7 04 24 28 a0 04 08 	movl   $0x804a028,(%esp)
 80483e6:	ff d0                	call   *%eax
 80483e8:	c9                   	leave  
 80483e9:	c3                   	ret    
 80483ea:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi

080483f0 :
 80483f0:	b8 28 a0 04 08       	mov    $0x804a028,%eax
 80483f5:	2d 28 a0 04 08       	sub    $0x804a028,%eax
 80483fa:	c1 f8 02             	sar    $0x2,%eax
 80483fd:	89 c2                	mov    %eax,%edx
 80483ff:	c1 ea 1f             	shr    $0x1f,%edx
 8048402:	01 d0                	add    %edx,%eax
 8048404:	d1 f8                	sar    %eax
 8048406:	75 01                	jne    8048409 
 8048408:	c3                   	ret    
 8048409:	ba 00 00 00 00       	mov    $0x0,%edx
 804840e:	85 d2                	test   %edx,%edx
 8048410:	74 f6                	je     8048408 
 8048412:	55                   	push   %ebp
 8048413:	89 e5                	mov    %esp,%ebp
 8048415:	83 ec 18             	sub    $0x18,%esp
 8048418:	89 44 24 04          	mov    %eax,0x4(%esp)
 804841c:	c7 04 24 28 a0 04 08 	movl   $0x804a028,(%esp)
 8048423:	ff d2                	call   *%edx
 8048425:	c9                   	leave  
 8048426:	c3                   	ret    
 8048427:	89 f6                	mov    %esi,%esi
 8048429:	8d bc 27 00 00 00 00 	lea    0x0(%edi,%eiz,1),%edi

08048430 <__do_global_dtors_aux>:
 8048430:	80 3d 28 a0 04 08 00 	cmpb   $0x0,0x804a028
 8048437:	75 13                	jne    804844c <__do_global_dtors_aux+0x1c>
 8048439:	55                   	push   %ebp
 804843a:	89 e5                	mov    %esp,%ebp
 804843c:	83 ec 08             	sub    $0x8,%esp
 804843f:	e8 7c ff ff ff       	call   80483c0 
 8048444:	c6 05 28 a0 04 08 01 	movb   $0x1,0x804a028
 804844b:	c9                   	leave  
 804844c:	f3 c3                	repz ret 
 804844e:	66 90                	xchg   %ax,%ax

08048450 :
 8048450:	a1 10 9f 04 08       	mov    0x8049f10,%eax
 8048455:	85 c0                	test   %eax,%eax
 8048457:	74 1f                	je     8048478 
 8048459:	b8 00 00 00 00       	mov    $0x0,%eax
 804845e:	85 c0                	test   %eax,%eax
 8048460:	74 16                	je     8048478 
 8048462:	55                   	push   %ebp
 8048463:	89 e5                	mov    %esp,%ebp
 8048465:	83 ec 18             	sub    $0x18,%esp
 8048468:	c7 04 24 10 9f 04 08 	movl   $0x8049f10,(%esp)
 804846f:	ff d0                	call   *%eax
 8048471:	c9                   	leave  
 8048472:	e9 79 ff ff ff       	jmp    80483f0 
 8048477:	90                   	nop
 8048478:	e9 73 ff ff ff       	jmp    80483f0 

0804847d :
 804847d:	55                   	push   %ebp
 804847e:	89 e5                	mov    %esp,%ebp
 8048480:	83 ec 20             	sub    $0x20,%esp
 8048483:	c7 45 e8 71 00 00 00 	movl   $0x71,-0x18(%ebp)
 804848a:	c7 45 ec 77 00 00 00 	movl   $0x77,-0x14(%ebp)
 8048491:	c7 45 f0 33 00 00 00 	movl   $0x33,-0x10(%ebp)
 8048498:	c7 45 f4 72 00 00 00 	movl   $0x72,-0xc(%ebp)
 804849f:	c7 45 f8 74 00 00 00 	movl   $0x74,-0x8(%ebp)
 80484a6:	c7 45 fc 59 00 00 00 	movl   $0x59,-0x4(%ebp)
 80484ad:	c7 45 e4 06 00 00 00 	movl   $0x6,-0x1c(%ebp)
 80484b4:	c7 45 e0 00 00 00 00 	movl   $0x0,-0x20(%ebp)
 80484bb:	eb 24                	jmp    80484e1 
 80484bd:	8b 45 e0             	mov    -0x20(%ebp),%eax
 80484c0:	8b 54 85 e8          	mov    -0x18(%ebp,%eax,4),%edx
 80484c4:	8b 4d e0             	mov    -0x20(%ebp),%ecx
 80484c7:	8b 45 08             	mov    0x8(%ebp),%eax
 80484ca:	01 c8                	add    %ecx,%eax
 80484cc:	0f b6 00             	movzbl (%eax),%eax
 80484cf:	0f be c0             	movsbl %al,%eax
 80484d2:	39 c2                	cmp    %eax,%edx
 80484d4:	74 07                	je     80484dd 
 80484d6:	b8 01 00 00 00       	mov    $0x1,%eax
 80484db:	eb 11                	jmp    80484ee 
 80484dd:	83 45 e0 01          	addl   $0x1,-0x20(%ebp)
 80484e1:	8b 45 e0             	mov    -0x20(%ebp),%eax
 80484e4:	3b 45 e4             	cmp    -0x1c(%ebp),%eax
 80484e7:	7c d4                	jl     80484bd 
 80484e9:	b8 00 00 00 00       	mov    $0x0,%eax
 80484ee:	c9                   	leave  
 80484ef:	c3                   	ret    

080484f0 :
 80484f0:	55                   	push   %ebp
 80484f1:	89 e5                	mov    %esp,%ebp
 80484f3:	57                   	push   %edi
 80484f4:	56                   	push   %esi
 80484f5:	53                   	push   %ebx
 80484f6:	81 ec ac 00 00 00    	sub    $0xac,%esp
 80484fc:	8d 95 68 ff ff ff    	lea    -0x98(%ebp),%edx
 8048502:	bb 80 86 04 08       	mov    $0x8048680,%ebx
 8048507:	b8 20 00 00 00       	mov    $0x20,%eax
 804850c:	89 d7                	mov    %edx,%edi
 804850e:	89 de                	mov    %ebx,%esi
 8048510:	89 c1                	mov    %eax,%ecx
 8048512:	f3 a5                	rep movsl %ds:(%esi),%es:(%edi)
 8048514:	c7 85 64 ff ff ff 20 	movl   $0x20,-0x9c(%ebp)
 804851b:	00 00 00 
 804851e:	c7 85 60 ff ff ff 00 	movl   $0x0,-0xa0(%ebp)
 8048525:	00 00 00 
 8048528:	eb 1c                	jmp    8048546 
 804852a:	8b 85 60 ff ff ff    	mov    -0xa0(%ebp),%eax
 8048530:	8b 84 85 68 ff ff ff 	mov    -0x98(%ebp,%eax,4),%eax
 8048537:	89 04 24             	mov    %eax,(%esp)
 804853a:	e8 31 fe ff ff       	call   8048370 
 804853f:	83 85 60 ff ff ff 01 	addl   $0x1,-0xa0(%ebp)
 8048546:	8b 85 60 ff ff ff    	mov    -0xa0(%ebp),%eax
 804854c:	3b 85 64 ff ff ff    	cmp    -0x9c(%ebp),%eax
 8048552:	7c d6                	jl     804852a 
 8048554:	c7 04 24 0a 00 00 00 	movl   $0xa,(%esp)
 804855b:	e8 10 fe ff ff       	call   8048370 
 8048560:	90                   	nop
 8048561:	81 c4 ac 00 00 00    	add    $0xac,%esp
 8048567:	5b                   	pop    %ebx
 8048568:	5e                   	pop    %esi
 8048569:	5f                   	pop    %edi
 804856a:	5d                   	pop    %ebp
 804856b:	c3                   	ret    

0804856c 
:
 804856c:	55                   	push   %ebp
 804856d:	89 e5                	mov    %esp,%ebp
 804856f:	83 e4 f0             	and    $0xfffffff0,%esp
 8048572:	83 ec 10             	sub    $0x10,%esp
 8048575:	83 7d 08 02          	cmpl   $0x2,0x8(%ebp)
 8048579:	74 1c                	je     8048597 
 804857b:	8b 45 0c             	mov    0xc(%ebp),%eax
 804857e:	8b 00                	mov    (%eax),%eax
 8048580:	89 44 24 04          	mov    %eax,0x4(%esp)
 8048584:	c7 04 24 00 87 04 08 	movl   $0x8048700,(%esp)
 804858b:	e8 a0 fd ff ff       	call   8048330 
 8048590:	b8 01 00 00 00       	mov    $0x1,%eax
 8048595:	eb 31                	jmp    80485c8 
 8048597:	8b 45 0c             	mov    0xc(%ebp),%eax
 804859a:	83 c0 04             	add    $0x4,%eax
 804859d:	8b 00                	mov    (%eax),%eax
 804859f:	89 04 24             	mov    %eax,(%esp)
 80485a2:	e8 d6 fe ff ff       	call   804847d 
 80485a7:	85 c0                	test   %eax,%eax
 80485a9:	75 0c                	jne    80485b7 
 80485ab:	e8 40 ff ff ff       	call   80484f0 
 80485b0:	b8 00 00 00 00       	mov    $0x0,%eax
 80485b5:	eb 11                	jmp    80485c8 
 80485b7:	c7 04 24 11 87 04 08 	movl   $0x8048711,(%esp)
 80485be:	e8 7d fd ff ff       	call   8048340 
 80485c3:	b8 02 00 00 00       	mov    $0x2,%eax
 80485c8:	c9                   	leave  
 80485c9:	c3                   	ret    
 80485ca:	66 90                	xchg   %ax,%ax
 80485cc:	66 90                	xchg   %ax,%ax
 80485ce:	66 90                	xchg   %ax,%ax

080485d0 <__libc_csu_init>:
 80485d0:	55                   	push   %ebp
 80485d1:	57                   	push   %edi
 80485d2:	31 ff                	xor    %edi,%edi
 80485d4:	56                   	push   %esi
 80485d5:	53                   	push   %ebx
 80485d6:	e8 d5 fd ff ff       	call   80483b0 <__x86.get_pc_thunk.bx>
 80485db:	81 c3 25 1a 00 00    	add    $0x1a25,%ebx
 80485e1:	83 ec 1c             	sub    $0x1c,%esp
 80485e4:	8b 6c 24 30          	mov    0x30(%esp),%ebp
 80485e8:	8d b3 0c ff ff ff    	lea    -0xf4(%ebx),%esi
 80485ee:	e8 01 fd ff ff       	call   80482f4 <_init>
 80485f3:	8d 83 08 ff ff ff    	lea    -0xf8(%ebx),%eax
 80485f9:	29 c6                	sub    %eax,%esi
 80485fb:	c1 fe 02             	sar    $0x2,%esi
 80485fe:	85 f6                	test   %esi,%esi
 8048600:	74 27                	je     8048629 <__libc_csu_init+0x59>
 8048602:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
 8048608:	8b 44 24 38          	mov    0x38(%esp),%eax
 804860c:	89 2c 24             	mov    %ebp,(%esp)
 804860f:	89 44 24 08          	mov    %eax,0x8(%esp)
 8048613:	8b 44 24 34          	mov    0x34(%esp),%eax
 8048617:	89 44 24 04          	mov    %eax,0x4(%esp)
 804861b:	ff 94 bb 08 ff ff ff 	call   *-0xf8(%ebx,%edi,4)
 8048622:	83 c7 01             	add    $0x1,%edi
 8048625:	39 f7                	cmp    %esi,%edi
 8048627:	75 df                	jne    8048608 <__libc_csu_init+0x38>
 8048629:	83 c4 1c             	add    $0x1c,%esp
 804862c:	5b                   	pop    %ebx
 804862d:	5e                   	pop    %esi
 804862e:	5f                   	pop    %edi
 804862f:	5d                   	pop    %ebp
 8048630:	c3                   	ret    
 8048631:	eb 0d                	jmp    8048640 <__libc_csu_fini>
 8048633:	90                   	nop
 8048634:	90                   	nop
 8048635:	90                   	nop
 8048636:	90                   	nop
 8048637:	90                   	nop
 8048638:	90                   	nop
 8048639:	90                   	nop
 804863a:	90                   	nop
 804863b:	90                   	nop
 804863c:	90                   	nop
 804863d:	90                   	nop
 804863e:	90                   	nop
 804863f:	90                   	nop

08048640 <__libc_csu_fini>:
 8048640:	f3 c3                	repz ret 

Disassembly of section .fini:

08048644 <_fini>:
 8048644:	53                   	push   %ebx
 8048645:	83 ec 08             	sub    $0x8,%esp
 8048648:	e8 63 fd ff ff       	call   80483b0 <__x86.get_pc_thunk.bx>
 804864d:	81 c3 b3 19 00 00    	add    $0x19b3,%ebx
 8048653:	83 c4 08             	add    $0x8,%esp
 8048656:	5b                   	pop    %ebx
 8048657:	c3                   	ret
After -d disassembling all we could see --->> main, check_key and display_result are the user functions. It has used simple call function. We can use breakpoint before check_key function and we should assign next instruction pointer with display_function address value. Thats it. 

root@Vijay:# gdb ./four

GNU gdb (GDB) 7.4.1-debian
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
...

Reading symbols from /root/Desktop/inctf 14/reverse/four...(no debugging symbols found)...done.
(gdb) 
(gdb) 
(gdb) disassemble main
'Dump of assembler code for function main:
   0x0804856c <+0>:	push   %ebp
   0x0804856d <+1>:	mov    %esp,%ebp
   0x0804856f <+3>:	and    $0xfffffff0,%esp
   0x08048572 <+6>:	sub    $0x10,%esp
   0x08048575 <+9>:	cmpl   $0x2,0x8(%ebp)
   0x08048579 <+13>:	je     0x8048597 

   0x0804857b <+15>:	mov    0xc(%ebp),%eax
   0x0804857e <+18>:	mov    (%eax),%eax
   0x08048580 <+20>:	mov    %eax,0x4(%esp)
   0x08048584 <+24>:	movl   $0x8048700,(%esp)
   0x0804858b <+31>:	call   0x8048330 
   0x08048590 <+36>:	mov    $0x1,%eax
   0x08048595 <+41>:	jmp    0x80485c8 

   0x08048597 <+43>:	mov    0xc(%ebp),%eax
   0x0804859a <+46>:	add    $0x4,%eax
   0x0804859d <+49>:	mov    (%eax),%eax
   0x0804859f <+51>:	mov    %eax,(%esp)
   0x080485a2 <+54>:	call   0x804847d 
   0x080485a7 <+59>:	test   %eax,%eax
   0x080485a9 <+61>:	jne    0x80485b7 

   0x080485ab <+63>:	call   0x80484f0 
   0x080485b0 <+68>:	mov    $0x0,%eax
   0x080485b5 <+73>:	jmp    0x80485c8 

   0x080485b7 <+75>:	movl   $0x8048711,(%esp)
   0x080485be <+82>:	call   0x8048340 
   0x080485c3 <+87>:	mov    $0x2,%eax
   0x080485c8 <+92>:	leave  
   0x080485c9 <+93>:	ret    
End of assembler dump.
(gdb) 
(gdb) 
(gdb) run
Starting program: /root/Desktop/inctf 14/reverse/four 
Cannot exec /root/Desktop/inctf 14/reverse/four -c exec '/root/Desktop/inctf 14/reverse/four' .
Error: No such file or directory
During startup program exited with code 127.
(gdb) 
(gdb) run wefef
Starting program: /root/Desktop/inctf 14/reverse/four wefef
Cannot exec /root/Desktop/inctf 14/reverse/four -c exec '/root/Desktop/inctf 14/reverse/four' wefef.
Error: No such file or directory
During startup program exited with code 127.
(gdb) 
(gdb) 
(gdb) q
So I tried to run the executable inside the gdb but it fails due to the shell with out right execute mode. After googling I found the answer as # export SHELL=/bin/sh (Problem Solved) 

root@Vijay:~/Desktop/inctf/reverse# file four
four: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, 
BuildID[sha1]=0x899a337216c40966fb57583c9ff45fcac0384cbb, not stripped

root@Vijay:~/Desktop/inctf/reverse# export SHELL=/bin/sh

root@Vijay:~/Desktop/inctf 14/reverse# gdb -q ./four
Reading symbols from /root/Desktop/inctf 14/reverse/four...(no debugging symbols found)...done.
(gdb) 
(gdb) disassemble main
Dump of assembler code for function main:
   0x0804856c <+0>:	push   %ebp
   0x0804856d <+1>:	mov    %esp,%ebp
   0x0804856f <+3>:	and    $0xfffffff0,%esp
   0x08048572 <+6>:	sub    $0x10,%esp
   0x08048575 <+9>:	cmpl   $0x2,0x8(%ebp)
   0x08048579 <+13>:	je     0x8048597 
   0x0804857b <+15>:	mov    0xc(%ebp),%eax
   0x0804857e <+18>:	mov    (%eax),%eax
   0x08048580 <+20>:	mov    %eax,0x4(%esp)
   0x08048584 <+24>:	movl   $0x8048700,(%esp)
   0x0804858b <+31>:	call   0x8048330 
   0x08048590 <+36>:	mov    $0x1,%eax
   0x08048595 <+41>:	jmp    0x80485c8 
   0x08048597 <+43>:	mov    0xc(%ebp),%eax
   0x0804859a <+46>:	add    $0x4,%eax
   0x0804859d <+49>:	mov    (%eax),%eax
   0x0804859f <+51>:	mov    %eax,(%esp)
   0x080485a2 <+54>:	call   0x804847d 
   0x080485a7 <+59>:	test   %eax,%eax
   0x080485a9 <+61>:	jne    0x80485b7 
   0x080485ab <+63>:	call   0x80484f0 
   0x080485b0 <+68>:	mov    $0x0,%eax
   0x080485b5 <+73>:	jmp    0x80485c8 
   0x080485b7 <+75>:	movl   $0x8048711,(%esp)
   0x080485be <+82>:	call   0x8048340 
   0x080485c3 <+87>:	mov    $0x2,%eax
   0x080485c8 <+92>:	leave  
   0x080485c9 <+93>:	ret    
End of assembler dump.

(gdb) r
Starting program: /root/Desktop/inctf 14/reverse/four 
Usage: /root/Desktop/inctf 14/reverse/four 
[Inferior 1 (process 6921) exited with code 01]

(gdb) r ddfdf
Starting program: /root/Desktop/inctf 14/reverse/four ddfdf
Sorry no flag for you
[Inferior 1 (process 6924) exited with code 02]
(gdb) 
(gdb) 
(gdb) run helloworld
Starting program: /root/Desktop/inctf 14/reverse/four helloworld
Sorry no flag for you
[Inferior 1 (process 6926) exited with code 02]
(gdb) 
(gdb)
(gdb) break check_key
Breakpoint 1 at 0x8048483
(gdb)
(gdb)
(gdb) info breakpoint
Num     Type           Disp Enb Address    What
1       breakpoint     keep y   0x08048483 
(gdb)
(gdb)
(gdb) run fake_value
Starting program: /root/Desktop/inctf 14/reverse/four fdef

Breakpoint 1, 0x08048483 in check_key ()
(gdb) info registers
eax            0xbffff6e2	-1073744158
ecx            0xbe28abd1	-1104630831
edx            0x2	2
ebx            0xb7fbdff4	-1208229900
esp            0xbffff478	0xbffff478
ebp            0xbffff498	0xbffff498
esi            0x0	0
edi            0x0	0
eip            0x8048483	0x8048483 
eflags         0x286	[ PF SF IF ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51

(gdb)
(gdb)
(gdb) set $eip = 0x080485ab
(gdb)
(gdb)
(gdb) continue
Continuing.
90aa184fe76e68d03c966602c094bb57
90aa184fe76e68d03c966602c094bb57
[Inferior 1 (process 7089) exited normally]
This is how I finished the challenge.

Comments

  1. AnonymousApril 11, 2022 at 3:48 AM

    Best 2021 Merit Casino Sites for Canadian Players - Casino
    We're here https://aprcasino.com/pluscasino/ to let you decide which is right for 메리트카지노 you. We're https://casinowed.com/merit-casino/ going to let you decide choegocasino.com사이트 on which of the best casinos in Canada offer 사설 토토 사이트

    ReplyDelete

Post a Comment

Popular posts from this blog

Python Speech recognition for Mac OS X

Hi Folks, I have been been searching for the    Python Speech recognition package especially for Mac OS.  I am not happy with the search results. Finally I got  https://pypi.python.org/pypi/SpeechRecognition/ (SpeechRecognition works only for the Linux distributions and Windows.) But I made it working for the Mac OS X by using flac.  Following are the instructions to make it run and modified code,  Prerequisite: Install Xcode in Unix Development mode Install Xcode - Command Line tools (Type ' xcode-select —install' in the terminal ) Install Port or Brew ( port    [or]   Brew   ) sudo brew install portaudio  [or]  sudo port install portaudio (for loading mic drivers) sudo pip install pyaudio [or] sudo easy_install install pyaudio (Mic Sources) sudo pip install SpeechRecognition [or] sudo easy_install install SpeechRecognition sudo port install flac Once you have finished w...
Read more

Baby Step Giant Step Algorithm Python Code

#Baby Step Giant Step DLP problem y = a**x mod n #Example 70 = 2**x mod 131 y = 70 a = 2 n = 131 s = floor(sqrt(n)) A = [] B = [] for r in range(0,s): value = y*(a^r) % n A.append(value) for t in range(1,s+1): value = a^(t*s) % n B.append(value) print A print B x1,x2 =0,0 for r in A: for t in B: if r == t: x1 = A.index(r) x2 = B.index(t) print x1,x2 break print 'the value of x is ', ((x2+1)*s - x1) % n # Answer
Read more

Simple Automation using Python - Atomac in Mac OS X

Image
The Product Automation in MAC OS X is quite easy if we have enough knowledge in the following languages and tools  Bash Scripts  Apple Scripts  Python especially ATOMac Knowledge in Accessibility. For more understanding of the LDTP: http://download.freedesktop.org/ldtp/doc/ldtp-tutorial.pdf LDTP - Tutorial is written by  Nagappan Alagappan. He has given the clear idea and architecture of the LDTP and its working. I have used the contents from the tutorial for knowledge sharing. Following are the few information and contents from  the LDTP - Tutorial. Few interesting key points, Linux Desktop Testing Project (LDTP) i s aimed at producing high quality test automation framework and cutting-edge tools that can be used to test GNU/Linux Desktop and improve it.  It uses the Accessibility libraries to poke through the application's user interface.  This idea has been extended to Microsoft Windows as Cobra , Mac OS X as ATOMa...
Read more