Reading Questions

Remember to submit your answer to this quetion BEFORE the next class.

(Binary bomb). A binary bomb (a.k.a., logical bomb), in its simplest form, is an executable that requires the user to input some secret code, if the user's input code does not match an internal code, then the bomb explodes (then you died... :-( ).

In this problem, you will be given such a binary bomb, and your job is to figure out what the secret code is. In this process, you'll learn how anti-disassembly techniques can help the bomb writer hide the secret code, and also learn how you can fight against it with anti-anti-disassembly techniques.

First, download the binary bomb to your Linux machine. And you may first change the mode:

          $ chmod 755 bomb
        
Then run the bomb, and the bomb will print:
          Please input the secret code:
        
and then you should input the secret code you guessed (Hint: the secret code is a string which is no more than 5 characters long.). And it's obvious that if the code you input does not match the internal pre-settled code, the bomb will explode and print something like:
          Wrong secret code! You failed!...
        
Only if your input code is corret, the bomb will print:
          Correct secret code! Success!
        

Your job is to figure out what's the correct secret code, using any way you think helpful (disassembly, debugging, etc.).

You may find the following steps helpful:

  1. First, disassemble this bomb with objdump:
          	  $ objdump -d bomb
          	  
    What's the output? Can you figure out where is the entry point main? What happened here? (Hint: read LLL book related chapter on ELF symbol table.)
  2. Now, let's debug this bomb with gdb:
          	  $ gdb -q bomb
          	  
    If you try to set a break point on main in gdb:
          	  (gdb) b main
          	  
    Do you succeed? Why? Then try to run this bomb:
          	  (gdb) r
          	  
    What's the output? Can you debug the bomb? (Don't worry about what's going on under the hood, as we'll discuss this in the future.)
  3. Finally, let's try a more professional disassembler (and debugger): ida. ida is not freeware, but you can download a demo one. Extract the tarball to your machine:
          	  $ tar -vxzf <the_tarball>
          	  
    And then run the ida from prompt:
          	  $ ./idaq
          	  
    Open the bomb and disassembly it. Can you figure out the secret code now? Can you debug the bomb with ida? (You can find out the ida manual here.)