Show me what you got!
Those who don't practice will be DISQUALIFIED!
0x01
Abradolf Lincler
Although his looks are intimidating defeating this monster is easy.
0x02
Morty Crypto
Although Morty looks rather simple from the outside a little debugging is required to fully understand his little brain.
0x03
Schmeckles
Hmm... you might have to see if you can solve this challenge from memory
0x04
Snowball
Where is my flag Summer School?
Need to know
Assembly provides all the building blocks to make any type of application. They are the molocules of sofware. This means that you'll need many instructions to perform simple operations like a for loop, or printing a string.
Reverse Engineering is the skill of figuring out what a black box is doing. This inclues being able to figure out what a set of assembly instrutions means. This doesn't mean you have to understand every single instruction. With enough practice you'll start reconising structures pretty quickly.
Before you get started you should understand the following concepts:
- Instructions: The set of instuctions the application needs to execute. This is basically your programming code converted into assembly (CPU instructions)
- Registers: Tiny pieces of memory on the CPU used for quickly storing and modifying values.
- Stack: The stack is the memory set aside as scratch space for a thread of execution. When a function is called, a block is reserved on the top of the stack for local variables and some bookkeeping data. When that function returns, the block becomes unused and can be used the next time a function is called. The stack is always reserved in a LIFO (last in first out) order; the most recently reserved block is always the next block to be freed. This makes it really simple to keep track of the stack; freeing a block from the stack is nothing more than adjusting one pointer.
- Heap: The heap is memory set aside for dynamic allocation. Unlike the stack, there's no enforced pattern to the allocation and deallocation of blocks from the heap; you can allocate a block at any time and free it at any time. This makes it much more complex to keep track of which parts of the heap are allocated or free at any given time; there are many custom heap allocators available to tune heap performance for different usage patterns.
Reference/Credit: https://stackoverflow.com/a/80113
Some common instructions are:
- je: Jump to an address if its equal to something. If unequal, continue with the flow.
- jmp: Perform a jump to an address.
- call: Jump to a new function while also pushing the current EIP/RIP value to the stack.
- cmp: compare two values with each other.
- lea: Load effecive address: load a pointer into a register
- mov: Move the value (at the pointer) into a register
Below I've also includd a few resources that you'll find useful:
Tools
Binary Ninja is a disassembler.
A disassembler is a computer program that translates machine language into assembly language—the inverse operation to that of an assembler. A disassembler differs from a decompiler, which targets a high-level language rather than an assembly language. Disassembly, the output of a disassembler, is often formatted for human-readability rather than suitability for input to an assembler, making it principally a reverse-engineering tool.
The free version will be sufficient for all challenges in 0x00
Focused mainly on x86 architecture, including x86-64 architecture, instruction encodings, reverse code engineering, and system programming in Windows and Linux OS.
his reference is intended to be precise opcode and instruction set reference (including x86-64). Its principal aim is exact definition of instruction parameters and attributes.
