📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  LD_PRELOAD Question

Topic created on: July 23, 2010 06:06 CDT by justanotherhacker .

Hello all,

Sorry to burst in like this.
But I am having a little problem RCEing this app.
Its a tiny-crackme I got from crackmes.de

This file has ptrace protection.
As viewed here:

% strace ./tiny-crackme
execve("./tiny-crackme", ["./tiny-crackme"], [/* 43 vars */]) = 0
[ Process PID=6933 runs in 32 bit mode. ]
ptrace(PTRACE_TRACEME, 0, 0x1, 0)       = -1 EPERM (Operation not permitted)
write(0, "Sorry but the process seems to b"..., 52Sorry but the process seems to be traced... Bye...
) = 52
_exit(0)  

So I wrote this: http://pastebin.com/fuAfvz03
Compiled it to a Shared-Library.
And tried to run it like this:
LD_PRELOAD=$PWD/libfakeptrace.so ./tiny-crackme
It didn't use my ptrace function.
I even tried this:
LD_LIBRARY_PATH=. LD_PRELOAD=libfakeptrace.so ./tiny-crackme


And I am all like W-T-F? I've done this trick before. And it worked. But now it doesn't.
So I hope some one here does have the time to tell me what I am doing wrong..?

Thanks in advance,
-JustAnotherHacker.

  monarch   July 23, 2010 07:37.54 CDT
I dont think LD_PRELOAD would work if they are accessing the symbol with dlopen. Try to intercept dlopen, or even the open call to see how they are loading libs.

  justanotherhacker   July 23, 2010 07:45.14 CDT
Ah, thanks for the idea. Ill give that a go =)

  monarch   July 23, 2010 08:52.08 CDT
I misunderstood this a little bit. I checked strace source and it attaches to the child proc before exec. This prevents a race condition where strace could miss some calls (if it attached after the exec)

You should be capable of using gdb on this process and set a break point at ptrace and write. That will give you the call stack of where the proc is trying to attach to itself.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit