Blog

Executable code – using Ghidra to decompile the binary.

void FUN_00400c62(void)

{
  ssize_t sVar1;
  long in_FS_OFFSET;
  int local_2c;
  char local_28 [24];
  undefined8 local_10;
 
  local_10 = *(undefined8 *)(in_FS_OFFSET + 0x28);
  setvbuf(stdin,(char *)0x0,2,0);
  setvbuf(stdout,(char *)0x0,2,0);
  setvbuf(stderr,(char *)0x0,2,0);
  puts(“From Zero to Hero”);
  puts(“So, you want to be a hero?”);
  sVar1 = read(0,local_28,0x14);
  local_28[sVar1] = ‘\0’;
  if (local_28[0] != ‘y’) {
    puts(“No? Then why are you even here?”);
                    /* WARNING: Subroutine does not return */
    exit(0);
  }
  puts(“Really? Being a hero is hard.”);
  puts(“Fine. I see I can\’t convince you otherwise.”);
  printf(“It\’s dangerous to go alone. Take this: %p\n”,system); <-address of system is given (libc leak not required)
  while( true ) {
    while( true ) {
      FUN_00400997();
      printf(“> “);
      local_2c = 0;
      __isoc99_scanf(&DAT_00401040,&local_2c);
      getchar();
      if (local_2c != 2) break;
      FUN_00400bb3();
    }
    if (local_2c == 3) break;
    if (local_2c != 1) goto LAB_00400dce;
    FUN_00400a4d();
  }
  puts(“Giving up?”);
LAB_00400dce:
                    /* WARNING: Subroutine does not return */
  exit(0);
}
*——————————————————————–
void FUN_00400997(void)

{
  puts(“1. Get a superpower”);
  puts(“2. Remove a superpower”);
  puts(“3. Exit”);
  return;
}
*——————————————————————–
void FUN_00400a4d(void)

{
  long lVar1;
  void *pvVar2;
  ssize_t sVar3;
  long in_FS_OFFSET;
  uint local_28;
  int local_24;
  long local_20;
 
  local_20 = *(long *)(in_FS_OFFSET + 0x28);
  local_28 = 0;
  local_24 = FUN_004009c2();
  if (local_24 < 0) {
    puts(“You have too many powers!”);
                    /* WARNING: Subroutine does not return */
    exit(-1);
  }
  puts(“Describe your new power.”);
  puts(“What is the length of your description?”);
  printf(“> “);
  __isoc99_scanf(&DAT_00400f0b,&local_28);
  getchar();
  if (0x408 < local_28) {  <-description is limited to specific size (controls max size of chunk)
    puts(“Power too strong!”);
                    /* WARNING: Subroutine does not return */
    exit(-1);
  }
  pvVar2 = malloc((ulong)local_28); <-request new chunk of memory
  *(void **)(&DAT_00602060 + (long)local_24 * 8) = pvVar2; <-save pointer to memory chunk in global array
  puts(“Enter your description: “);
  printf(“> “);
  lVar1 = *(long *)(&DAT_00602060 + (long)local_24 * 8); <-pointer at current array index
  sVar3 = read(0,*(void **)(&DAT_00602060 + (long)local_24 * 8),(ulong)local_28);
  *(undefined *)(sVar3 + lVar1) = 0; <-Null byte written at end of data
  puts(“Done!”);
  if (local_20 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}
*——————————————————————–
int FUN_004009c2(void)

{
  int local_c;
 
  local_c = 0;
  while( true ) {
    if (6 < local_c) { <-only 7 elements “powers” allowed
      return -1;
    }
    if (*(long *)(&DAT_00602060 + (long)local_c * 8) == 0) break;
    local_c = local_c + 1;
  }
  return local_c; <-index of next free element in array
}
*——————————————————————–
void FUN_00400bb3(void)

{
  long in_FS_OFFSET;
  uint local_14;
  long local_10;
 
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  local_14 = 0;
  puts(“Which power would you like to remove?”); <-specify which element in the array of pointers
  printf(“> “);
  __isoc99_scanf(&DAT_00400f0b,&local_14);
  getchar();
  if (6 < local_14) {
    puts(“Invalid index!”);
                    /* WARNING: Subroutine does not return */
    exit(-1);
  }
  free(*(void **)(&DAT_00602060 + (ulong)local_14 * 8)); <-release memory into tcache
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}

*——————————————————————–
void FUN_00400a02(void)

{
  int iVar1;
  FILE *__fp;
 
  __fp = fopen(“flag.txt”,”r”);
  if (__fp != (FILE *)0x0) {
    while( true ) {
      iVar1 = _IO_getc((_IO_FILE *)__fp);
      if ((char)iVar1 == -1) break;
      putchar((int)(char)iVar1);
    }
  }
  return;
}