Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  LD_PRELOAD Question

Topic created on: July 23, 2010 06:06 CDT by justanotherhacker .

Hello all,

Sorry to burst in like this.
But I am having a little problem RCEing this app.
Its a tiny-crackme I got from crackmes.de

This file has ptrace protection.
As viewed here:

% strace ./tiny-crackme
execve("./tiny-crackme", ["./tiny-crackme"], [/* 43 vars */]) = 0
[ Process PID=6933 runs in 32 bit mode. ]
ptrace(PTRACE_TRACEME, 0, 0x1, 0)       = -1 EPERM (Operation not permitted)
write(0, "Sorry but the process seems to b"..., 52Sorry but the process seems to be traced... Bye...
) = 52
_exit(0)  

So I wrote this: http://pastebin.com/fuAfvz03
Compiled it to a Shared-Library.
And tried to run it like this:
LD_PRELOAD=$PWD/libfakeptrace.so ./tiny-crackme
It didn't use my ptrace function.
I even tried this:
LD_LIBRARY_PATH=. LD_PRELOAD=libfakeptrace.so ./tiny-crackme


And I am all like W-T-F? I've done this trick before. And it worked. But now it doesn't.
So I hope some one here does have the time to tell me what I am doing wrong..?

Thanks in advance,
-JustAnotherHacker.

  monarch   July 23, 2010 07:37.54 CDT
I dont think LD_PRELOAD would work if they are accessing the symbol with dlopen. Try to intercept dlopen, or even the open call to see how they are loading libs.

  justanotherhacker   July 23, 2010 07:45.14 CDT
Ah, thanks for the idea. Ill give that a go =)

  monarch   July 23, 2010 08:52.08 CDT
I misunderstood this a little bit. I checked strace source and it attaches to the child proc before exec. This prevents a race condition where strace could miss some calls (if it attached after the exec)

You should be capable of using gdb on this process and set a break point at ptrace and write. That will give you the call stack of where the proc is trying to attach to itself.

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
waleedassar

There are 28,224 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit