A showcase of interesting debugging sessions and other technical writeups related to software development.
When faced with some systems issue, tracing syscalls usually elucidates us on possible causes. But what if the syscall result itself is elusive? This was the case with evince-thumbnailer on a Debian system, which was failing to create any thumbnail files: openat(AT_FDCWD, "/tmp/o.png", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied) But we could replicate this exact syscall with a…
Introduction For these 2 tasks, we are given a binary targeting a console system that uses an 8-bit processor, although it also supports 16-bit addressing. Despite this lesser known target, we can still apply general approaches to understand its internals. Part 1 Back to 1980s Download: game.bin Let’s look at the first bytes with xxd -l $((0x20)) game.bin : 00000000: 6720 4743 4520 3230 3232 80fd…
Introduction We are given an executable and a core dump generated near the end of its execution. If we run the executable run multiple times, we see that it prints out 4 different flags, so we need to figure out the random bytes that were used to build the flags of the given core dump. Description When you get a core file, you’re usually pretty sad. Hopefully this one makes you happy. Download:…
When attempting to make a https request from a Qt app, a terse error was returned: Which seemed odd, given that curl had no issue doing the same request, without the user specifying any additional certificates. So, what was different? Analysis With strace -f -k , we don’t find the message text verbatim, but we can search for the last instance of “handshake”, then look up for application specific…
Ever wanted TCP, but instead of directly connecting a client to a server with sockets, you process requests and responses by writing and reading files? What do you mean “no”? Let me give you one contrived use case. Suppose you are connecting to a Windows host via RDP. Only the RDP port is open to the internet, and the host can only reach other hosts on a private network. Apparently, there’s no way…
Beginner’s Rev 2021 Don’t spend too much on reading the code. Once you get an idea of the behavior, I recommend you to try some dynamic analysis with various tools. Author’s Writeup , Download Analysis With strace we spot several calls to fork() and wait() , suggesting some computation being processed from child processes: clone(child_stack=NULL,…
Lack of familiarity with a binary format leads us to handle them with conservative expectations. Today, let’s subvert two of these expectations with varying degrees of usefulness, each explored in a dedicated part. Previously, I dissected a zip file that had its body AES encrypted , despite the compression method being set to the typical DEFLATE. This time, we will dig into the DEFLATE format’s…
Introduction We are given a stripped rust binary. Functions in rust seem to feature convoluted stack setups that don’t play well with Ghidra’s decompiler. However, we can mostly avoid them in this binary, since the relevant logic is contained in a single function manipulating few data structures. Description Senpai plis find me a way. Author: Freakston, silverf3lix nc 34.94.181.140 4200 Download…
To workaround a filesystem feature, I decided to try dynamic preloading, bumping into a bunch of libc corners… Analysis In this case, a git repository was failing to checkout: fatal: unable to checkout working tree warning: Clone succeeded, but checkout failed. You can inspect what was checked out with 'git status' and retry with 'git restore --source=HEAD :/' If we run with strace -e file :…
Without a good intuition of what packet fields to consider, finding side-channel data in packet captures becomes a bit harder. While wireshark provides some statistics views to summarize conversations, we may desire to look into other packet details as well.