{"id":1348,"date":"2024-10-25T15:29:05","date_gmt":"2024-10-25T19:29:05","guid":{"rendered":"https:\/\/studentorgs.syr.edu\/isc\/?p=1348"},"modified":"2024-10-25T15:32:51","modified_gmt":"2024-10-25T19:32:51","slug":"reverse-engineering-walkthrough-10-1-meeting","status":"publish","type":"post","link":"https:\/\/studentorgs.syr.edu\/isc\/2024\/10\/25\/reverse-engineering-walkthrough-10-1-meeting\/","title":{"rendered":"Reverse Engineering Walkthrough – 10\/1 Meeting"},"content":{"rendered":"
\n

ISC_Crackme Walkthrough<\/h1>\n

By Townsend Southard Pantano<\/p>\n

Github<\/a><\/p>\n

This simple license validator is designed to expose the user to a revere engineering workflow, using Binary Ninja to reverse the license format and validation to bypass the license check and generate a license that the program thinks is valid.<\/span><\/p>\n<\/div>\n

\n

The goal:<\/h3>\n

Generate your own license that will be accepted by the program. Your license should result in valid values for all the fields under<\/span>\u00a0<\/span>License Details<\/code>:<\/span><\/h3>\n<\/div>\n

\"successful_demo.png\"<\/a>\"img.png\"<\/a><\/p>\n

\n

Running the program:<\/h3>\n

When the program starts, you should see a UI that looks similar to this:<\/span><\/h3>\n<\/div>\n

\"img.png\"<\/a><\/p>\n

Pressing “Check License” yields an error message,\u00a0<\/span>Invalid number of fields - The license needs more information<\/code>. While not the most useful, that error message lets us know that the license contains several fields, each with some sort of information.<\/p>\n

\n

Loading in Binary Ninja:<\/h3>\n

<\/span>Binary Ninja<\/a>\u00a0<\/span>is a reverse engineering platform that allows us to disassemble and analyze the program. We will use it to reverse engineer the license format and validation to generate a valid license. After loading the program into Binja, set the view mode to “Pseudo C” at the top of the disassembly view to make the disassembly easier to read. The function names can be seen in the left top panel, under “Symbols”, and the strings can be found by clicking on the double-quote icon in the column to the right of the disassembly view.<\/span><\/h3>\n<\/div>\n
\n

Note: Details in the screenshots will be different on different builds of the program. The view in the screenshots is the Linux build of the program<\/p>\n<\/blockquote>\n

\n

Strings: The low-hanging fruit<\/h4>\n

We can search the strings panel for the error message we saw earlier,<\/span>\u00a0<\/span>Invalid number of fields - The license needs more information<\/code>, to try and find the function that causes it.<\/span><\/h4>\n<\/div>\n

There will be one result, and double-clicking on it will take us to the strings table. While not the validation function that we were hoping for, the strings table is just as useful.<\/p>\n

\"img_1.png\"<\/a><\/p>\n

The strings table is mostly in order, and the possible error messages are towards the bottom of the screenshot: Here are the error messages:<\/p>\n