inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)

The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:

-  main.main

-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 

Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"

The incoming channel will determine the final message.

Dexor and print each byte of the "Nope!" message.

This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!

Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.

This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx

This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1

(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.

Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]

Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.

Related posts

1. Android Hack Tools Github
2. Hacker Tools Online
3. Hacking Tools For Windows Free Download
4. Best Pentesting Tools 2018
5. Pentest Tools Open Source
6. Blackhat Hacker Tools
7. Hack Tools 2019
8. Hack Tools 2019
9. Pentest Box Tools Download
10. Hack Tools For Windows
11. Hacking Tools Pc
12. Bluetooth Hacking Tools Kali
13. Underground Hacker Sites
14. Wifi Hacker Tools For Windows
15. Nsa Hack Tools
16. Hacking Tools For Pc
17. Hacking Tools Windows
18. Free Pentest Tools For Windows
19. Hacks And Tools
20. Hack Tools 2019
21. Hacker Hardware Tools
22. Pentest Tools Github
23. Bluetooth Hacking Tools Kali
24. Hack Tools For Pc
25. Termux Hacking Tools 2019
26. Physical Pentest Tools
27. Hack Tools For Pc
28. Hacking Tools Free Download
29. Pentest Tools Framework
30. Hacking Tools Mac
31. Hacker Tools Online
32. Hacking Tools Windows
33. How To Install Pentest Tools In Ubuntu
34. Hacker Tools Free
35. Hacker Tools 2019
36. Pentest Tools For Android
37. New Hack Tools
38. Hacker Hardware Tools
39. Pentest Tools Review
40. Hacking Tools For Windows 7
41. Hack Tools For Games
42. Bluetooth Hacking Tools Kali
43. World No 1 Hacker Software
44. Pentest Tools Website
45. Hack Tools For Pc
46. Hacking Tools Name
47. Beginner Hacker Tools
48. Hack Tools 2019
49. Pentest Tools For Android
50. Pentest Tools Url Fuzzer
51. Hacking Tools Kit
52. Pentest Tools Review
53. Pentest Tools Open Source
54. Hacker
55. Hack Tools Download
56. Hacker Tools For Windows
57. How To Install Pentest Tools In Ubuntu
58. Hacker Techniques Tools And Incident Handling
59. Pentest Tools List
60. Physical Pentest Tools
61. Nsa Hack Tools
62. Blackhat Hacker Tools
63. Pentest Reporting Tools
64. Hacking Tools Windows 10
65. Hacking Tools For Windows 7
66. Hacker Tool Kit
67. Hacker Tools Hardware
68. Pentest Tools Website
69. Pentest Tools Subdomain
70. Hacker Tools For Ios
71. Hack Tools
72. Hacking Tools Usb
73. Hack Tool Apk No Root
74. Hacker Tools
75. Hack Tools Mac
76. Game Hacking
77. Hack App
78. Termux Hacking Tools 2019
79. Hacker Tools 2019
80. Pentest Tools Free
81. Hack Tools For Games
82. Hack Rom Tools
83. Hack Tools Mac
84. How To Make Hacking Tools
85. Hacking Tools Hardware
86. Pentest Automation Tools
87. Hack Tools For Pc
88. Hack Tools 2019
89. Pentest Tools Download
90. Pentest Tools Windows
91. How To Install Pentest Tools In Ubuntu
92. Computer Hacker
93. Hacker Tools For Windows
94. Hackers Toolbox
95. Physical Pentest Tools
96. Hacker Tools Free
97. Hacking Tools 2019
98. Game Hacking
99. Best Hacking Tools 2020
100. Hacking Tools For Beginners
101. Pentest Tools Online
102. Ethical Hacker Tools
103. Hacking Tools For Beginners
104. Install Pentest Tools Ubuntu
105. Pentest Tools Apk
106. Hacker Tools Free
107. Hacker Tools 2020
108. Hack Tools For Windows
109. Pentest Tools Find Subdomains
110. Hacking Tools Software
111. Hacking Tools Free Download
112. Pentest Tools Website
113. Pentest Tools Nmap
114. Pentest Tools Url Fuzzer
115. Hacking Tools Free Download
116. Hack Apps
117. Hacking Tools For Windows 7
118. Hacking App
119. Hacker Tools Windows
120. Hack Tools For Games
121. Hacker Techniques Tools And Incident Handling
122. Hacking Tools Software
123. Termux Hacking Tools 2019
124. Pentest Tools Bluekeep
125. Best Hacking Tools 2020
126. Bluetooth Hacking Tools Kali