inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)

The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:

-  main.main

-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 

Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"

The incoming channel will determine the final message.

Dexor and print each byte of the "Nope!" message.

This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!

Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.

This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx

This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1

(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.

Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]

Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.

Related articles

1. Nsa Hack Tools Download
2. Hacking Tools Usb
3. Hacking Tools For Windows
4. Pentest Tools Bluekeep
5. Pentest Tools Find Subdomains
6. Nsa Hack Tools
7. Hacker Tools For Windows
8. Hack Tools Online
9. Hacking Tools Usb
10. Hacker Tools 2020
11. Beginner Hacker Tools
12. Bluetooth Hacking Tools Kali
13. Pentest Tools Linux
14. Pentest Tools Windows
15. Hacker Hardware Tools
16. How To Make Hacking Tools
17. Underground Hacker Sites
18. Top Pentest Tools
19. Hacking Tools Download
20. Hack Website Online Tool
21. Pentest Tools Kali Linux
22. Tools For Hacker
23. Hacker Tools Apk
24. Hacker Tool Kit
25. Hacking Tools Windows
26. Hacking Apps
27. Hack Tools Pc
28. Hacking Tools Kit
29. Pentest Tools For Ubuntu
30. New Hacker Tools
31. Pentest Tools Find Subdomains
32. Hacker Tools Free Download
33. Hacker Hardware Tools
34. Pentest Reporting Tools
35. Pentest Tools List
36. Hack Tools Download
37. Pentest Tools Alternative
38. Wifi Hacker Tools For Windows
39. Hack Tools Download
40. Hacker Tools Apk
41. Pentest Tools Framework
42. Hack App
43. Pentest Tools Url Fuzzer
44. Hacking Tools For Windows Free Download
45. Hacker Tools Free Download
46. Hacker Tools For Ios
47. Hacking Tools Software
48. Hacker Tools For Windows
49. Hacker Tools Online
50. Kik Hack Tools
51. Hack Tools 2019
52. Hacking Tools Online
53. New Hack Tools
54. Hacking Tools Windows 10
55. Hacking Tools For Windows Free Download
56. Blackhat Hacker Tools
57. Hacking Tools Kit
58. Pentest Tools Website Vulnerability
59. New Hacker Tools
60. Pentest Tools Download
61. Hacking Tools Online
62. Hacker Tools For Pc
63. Hack Tools 2019
64. Hack Tools 2019
65. Hack Tool Apk
66. Hacker Security Tools
67. Best Hacking Tools 2020
68. Hack Tool Apk
69. Hacker Tools Apk Download
70. Hacking Tools Hardware
71. Hacker Tools Online
72. Game Hacking
73. Blackhat Hacker Tools
74. Hacking Tools Download
75. Hacker Techniques Tools And Incident Handling
76. Pentest Tools Alternative
77. Pentest Tools Download
78. Nsa Hack Tools Download
79. World No 1 Hacker Software
80. Pentest Tools Alternative
81. Hacking Tools And Software
82. Pentest Tools Port Scanner
83. Hacking Tools Kit
84. Tools For Hacker
85. Hacking Tools Software
86. Hacker Tools For Windows
87. Hacking Tools For Kali Linux
88. Hacker Tools For Mac
89. Pentest Tools Windows
90. Nsa Hack Tools
91. Hack Rom Tools
92. Hacker Tools For Windows
93. Hack Tool Apk No Root
94. Pentest Tools Url Fuzzer
95. Pentest Tools Find Subdomains
96. Kik Hack Tools
97. Pentest Automation Tools
98. Hacker
99. Usb Pentest Tools
100. Pentest Tools Website
101. Pentest Tools Url Fuzzer
102. Hacker Tool Kit
103. Hacker Tools For Pc
104. Pentest Tools Android
105. Hacking Tools Free Download
106. Pentest Tools Tcp Port Scanner
107. Pentest Tools Alternative
108. Pentest Tools Port Scanner
109. Underground Hacker Sites
110. Hak5 Tools
111. Hack Tool Apk
112. Hack Tools Github
113. Hacks And Tools
114. Hack Tools For Pc
115. Hak5 Tools
116. Hacker Tools Software
117. Hack Tools Online
118. Hacking Tools For Windows
119. Hacker Tools For Windows
120. Hack Tools
121. Blackhat Hacker Tools
122. Hak5 Tools
123. Pentest Box Tools Download
124. Best Hacking Tools 2019
125. Hack Apps
126. Hacking Tools For Windows 7
127. Hacks And Tools
128. Hacking Tools Windows 10
129. Hack Tools
130. Nsa Hacker Tools
131. Hacking Apps
132. Game Hacking
133. Easy Hack Tools
134. What Are Hacking Tools
135. Pentest Tools Url Fuzzer
136. Hacking Tools Usb