CTF-Writeups/TryHackMe/Intro_to_x86-x64.md

# TryHackMe-Intro to x86-x64

Username : zx 
password : reismyfavl33t

SSH into the machine with these credentials.

## Task 2

Executing `intro` binary will produce this result

```
tryhackme@ip-10-10-213-153:~/introduction$ ./intro 
value for a is 1 and b is 2
value of a is 2 and b is 1

```

To debug this we use `radare` .

`r2 -d intro`

```
tryhackme@ip-10-10-213-153:~/introduction$ r2 -d intro
Process with PID 1507 started...
= attach 1507 1507
bin.baddr 0x55ebd6a73000
Using 0x55ebd6a73000
asm.bits 64
 -- Ask not what r2 can do for you - ask what you can do for r2
[0x7fdc18484090]> 
```

Using command `aa` will scan for all symbols and entry points in the executable.

```
[0x7fdc18484090]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x7fdc18484090]> 
```

Finding list of functions in `radare` is command `afl` that returns a list of functions in a binary

<img src="https://imgur.com/xFzPNnK.png"/>

Now to analyze a function we use a command `pdf @function_name` which stands for print disassembly function


<img src="https://imgur.com/ITXqI1O.png"/>

Here left column instruction which is starting from `0x55ebd6a7366a` are memory addresses of instructions

Middle column are instructions `4883ec08`  encoded in bytes which is machine code.

Right column is the human readable instruction `subq $8, %rsp`

%rsp stack pointer (holds the recent memory address)
%rbp frame pointer (points to frame of function being executed)


## Simple Instruction Example

An assembly instruction looks like this

`movq $3 rax ` (movq for 64 bit)
`movl $3 rax`  (movl for 32 bit)

In assembly constatns are represented by this `$3` 

Here the instruction will move a value 3 into a register named rax.

To move value from register to register

`movq %rax %rbx` 


There are some more instructions in assebmly like

```
addq  (add instruction)
subq  (subtract instruction)
imulq (multiply instruction)
andq  (perform AND operation)
orq   (perform OR operation)
xorq  (perform XOR operation
```

## If Statements

if (x == 3 ):
	return 3
else:
	return 0	

Like we see in programming if else statements that have a conidition that needs to be true and if it's true what instruction it performs or if it's false what will it do so assembly it's something like this

`cmpq %rax %rbx` This will just compare the values of two registers

Now after we compare these values it would not do anything until we tell it what instruction is to be performed so we issue a `jump` instruction which can goto different part of code from a point where that instruction occurs

```
movq $10 rax
cmp %rax %rbx
je equal

equal:
```
What this block of instruction will do is assign `rax` register a value of 10

```
rax = 10
```
then will compare `rax` and `rbx` it would not do anything until we perform a jump compare (je equal) if they are equal

```
if rax == rbx

```

Then it will jump to next block instruction which we have named `equal` it's more like a function

So now let's do some room tasks

<img src="https://imgur.com/gxd5EtH.png"/>

I have loaded up the binary in `radare` 

<img src="https://imgur.com/c46VV9W.png"/>

Then selecting main function and adding two breakpoints with `db [instruction_memory_address]`

<img src="https://imgur.com/iq5owfW.png"/>

When we'll run the binary it will hit at the breakpoint and two see the instructions uptil that point we'll use `dr` command

<img src="https://imgur.com/iq5owfW.png"/>

Now for doing these tasks we have to use `if2` binary

<img src="https://imgur.com/2lb6H8e.png"/>

Now add a breakpoint at 

`0x55feb072c630      816dfce70300.  subl $0x3e7, var_4h`

```
db 0x55feb072c630 (this is before the return and pop instruction)
dc
px @ rbp-0x4
px @ rbp-0x8
```

1.  What is the value of var_8h before the popq and ret instructions?
	You'll get in the offset 60 which is in hex so after converting it to decimal it would be 

	<img src="https://imgur.com/0yfXHbr.png"/>

	<img src="https://imgur.com/tFQZx40.png"/>

    `96`

2.  what is the value of var_ch before the popq and ret instructions?

    We can see that only value 0 is assigned to `var_ch` and no further instructions and done on it until pop and return instruction
   
   `0`

3.  What is the value of var_4h before the popq and ret instructions?
	
	`1`
	
4. ` What operator is used to change the value of var_8h, input the symbol as your answer(symbols include +, -, *, /, &, |):`


```
0x55feb072c623      8365f864       andl $0x64, var_8h
```
`&`

## Loops


<img src="https://imgur.com/ufdEZDN.png"/>

<img src="https://imgur.com/tdbPULD.png"/>

<img src="https://imgur.com/3hBTWas.png"/>


1. What is the value of var_8h on the second iteration of the loop?
	`5`


2. What is the value of var_ch on the second iteration of the loop?
	`0`

<img src="https://imgur.com/62ObddX.png"/>

3. What is the value of var_8h at the end of the program?
	
	`2`

4. What is the value of var_ch at the end of the program?

	`0`


## Crackme 1

<img src="https://imgur.com/FFTp5S8.png"/>

<img src="https://imgur.com/luKIkrs.png"/>

Now we know the password is 127 in between you can see `.` and `.01` so by this it is referring to localhost which is 127.0.0.1

`127.0.0.1`


## Crackme 2

<img src="https://imgur.com/RcqRMI4.png"/>

Here we see a text file which being read form the binary on reading the file we see `vs3curepwd` but when entered it isn't the right password ,so I got stuck but through "reversing" the text that was the right password