| Baby Keygen 3 |
This Crackme has a harmless bug.
We have such pseudocode:
main:
key = get_user_input();
strcpy(user_input, key2);
valid = valid_key(user_input);
get_user_input:
char *user_input;
user_input = (char *)malloc(0xFu);
// Skip unrelated codes...
return user_input;
valid_key(key_to_valid):
char *localkey;
strcpy(localkey, key_to_valid);
// Skip unrelated codes...
In valid_key(), the localkey is just a qword ptr and won't be malloced. In most cases, it should cause a segment fault.
But here is the thing: get_user_input() also defines a qword ptr at the same place and it IS malloced. strcpy won't touch that address. So here localkey has exactly same address of key in main(). Since variable key is never used in the rest of codes, no logic error can be observed.
If a different strcpy() is used and breaks the stack, a segment fault is very likey to happen.
|
2026-08-28 10:32 |