Patching Binaries with Pwntools | BE QUICK OR BE DEAD 2 [29] picoCTF 2018

[@X3eRo0]

very cool. be-quick-or-be-dead was solved by just loading in the gdb and running

[@pepemunic3661]

that was fantastic

[@hyronharrison8127]

agreed!

[@tommyeldiablo]

Nicely explained , loved it .

[@vhgfhjykuhghfcjkgchj]

Why do we need to do (number & 0xFFFFFFFF)? Because if I understand correctly the register can only hold so large of a value, to be specific 0xFFFFFFFF is only like a 11-digit number while our fibbonaci number is close to 50. So how exactly does our huge number fit into a 32-bit register if its way larger than what the register can hold?

[@cnxis]

Awesome! Nice

[@WIKIKALI]

Thanks a lot

[@ShalvinKumar7]

Hey! If you can do a bit of GDB tutorial it will helpful for us CTF solvers :)

[@ahmedlimam2241]

Fantastic! Do you know any good resources for pwntools ?

[@lakshayarora3916]

Awesome technique bro

[@Salsuero]

Did you need to patch the alarm function if you force-fed the correct number? Wouldn't everything be able to run within the alarm's window if no calculation needed to be done?

[@_JohnHammond]

If we force-fed the correct number that function would return immediately and patching the alarm wouldn't entirely be necessary, you are right. But, patching that alarm function and generating a new binary might be a great move if you needed to do more dynamic analysis. Thanks for watching!

[@Salsuero]

@@_JohnHammond Thanks for the (super quick) response and for the entertaining/educational videos.

[@AshishKumar-qi5gk]

Cool

[@calciumdd7696]

That's pretty cool

[@0xZ0F]

You should do Python tutorials :)

[@_JohnHammond]

I have a couple old ones-- there should be a playlist on my channel, but I certainly plan to revisit and remake a series. "Back to Basics" or something -- the old series is not the best quality. Thanks for watching!

[@jigerjain]

Agree!

[@mina_ashraf]

@@_JohnHammond still waiting for it 😂

[@_JohnHammond]

@@mina_ashraf Eventually :)

[@magnoliacomputerscience7334]

Which is better for messing with binaries? Hopper or Binary Ninja? very curious

[@_JohnHammond]

Really I think that is a matter of choice, I have gotten to using Hopper but I know Binary Ninja is quality as well. May as well try both and see which one feels more "comfortable!" :D

[@pwnweb5734]

this is good, how i did it was created a new program on c with hashmaps :p

[@sontapaa11jokulainen94]

Why not just use gdb?

[@edwardg7829]

Hey, Hopper can't see the file and binary ninja won't analyse it: no support for elf x86_64 architecture How did you configure hopper to get this working? any ideas on how to open it in binary ninja would also be much appreciated

[@meenasinghal733]

Hi can you post a tutorial on how to use pwntools in Python

[@ThePraeceps]

What was the mv command you did it had a weird format

[@_JohnHammond]

The mv command was a quick technique to just change a file name, and add on the segment there following the comma. So it says _COMPLETE at the end of the folder :)

[@ThePraeceps]

Neat thanks!

[@HabibRahman-uo4to]

boss we are still waiting for your webhacking methology

[@samyaktjain698]

Why we need to do (number & OxFFFFFFFF) ?

[@daedreaming6267]

Because number exceeds a 32 bit value. EAX is a 32 bit register.

[@HabibRahman-uo4to]

you promise us on live stream

[@MrHatoi]

There's a _much_ easier way to do this. All you have to do is write a short C program that blocks SIGALRM with sigprocmask and then use an exec function to run the original binary.