quietearth [General News 06.06.07]



DISCLAIMER: This is for informational purposes only. I am not responsible for what anyone does with this information.

Ok, so we have a linux binary, and you start it up, but it gives you a message like "You cannot run this program" and exits. Dang. Well one way to go about getting around this is our friend objdump.


First let's find the offset of the "You cannot run this program" message. (note: older objdump options may be different)
# objdump -s program > out1
Which produces something like this, so we look through and find our offset:
 
 80fb330 58585800 596f7520 63616e6e 6f742072  XXX.You cannot r
 80fb340 756e2074 68697320 70726f67 72616d2e  un this program.
 80fb350 58585858 58585858 58585858 58585858  XXXXXXXXXXXXXXXX
 80fb360 58585858 58585858 58585858 58585858  XXXXXXXXXXXXXXXX

Now we can see that the message offset starts at 0x80fb334. Ok now let's look for this string in the code. We're going to break it down into assembly.
# objdump -d program > out2
Now let's look for 80fb334.
 
 8020b4b:       75 29                   jne    0x8041a92
 8020b4d:       c7 44 24 08 c5 19 24    movl   $0x82419c5,0x8(%esp,1)
 8020b54:       08 
 8020b55:       89 5c 24 04             mov    %ebx,0x4(%esp,1)
 8020b59:       c7 04 24 34 b3 0f 08    movl   $0x80fb334,(%esp,1)

Now what's key here is the most recent jump BEFORE the string is accessed, and as you can see it's a jne, jump if not equal. So we load up a hex editor, I like to use khexedit (the KDE hex editor), and we need to search by hexadecimal so we can get close to the routine.

We search for "c7 44 24 08 c5 19 24" that way we know that the "75 29" which is the jne is right before. Now if you don't know assembly, you can look around in the file "out2" which is our assembly output and find the value of a "je", that is jump if equal. The value for je is 74, so all we do is change the 75 to a 74 and voila we're done. The program now runs because we told it to do the opposite when it was doing whatever checking. Now you're program might be a bit more complicated then that, so you can use the likes of ltrace which traces library calls, and also add in the -S option to display system calls as well.

If anyone has any other ways to do this, or any more information, please post!

Leave a comment

Your Comment

Related articles