Bypass Me | LLDB

In this challenge I experience Debugging without Ghidra, Whenever before that I tries to solve reverse engineering puzzle my mostly used tools are GDB (GNU Debugger) and Ghidra. I did always use Ghidra to get pseudo code from machine language, then try to explore runtime activities inside that using GDB.

But In this challenge I feel helpless without GDB and Ghidra. I have to reverse engineer binary file bypassme.bin within from server itself using tool LLDB (Low Level Debugger). So first I start from reading about LLDB and how does it different from GDB.

• LLDB and GDB both are used at Debugging for C and C++ code.
• LLDB are debugger for Clang++ compiler (LLVM project), whereas GDB are debugger for GNU (g++) compiler.
• LLDB follow modular and reusable library architecture, whereas GDB follow monolithic architecture
• LLDB are used at macOS, iOS, GDB are widely used at Linux ecosystem

As I previously know commands for GDB while debugging, now I want to know commands used for LLDB and below are list of those commands:

• Start LLGB

lldb bypassme.bin

• List of functions in binary file

image lookup -r -n .

• Disassemble specific function

disassemble --name <main>

• Next N Instructions

di --pc --count <N>

• Steps comand :-

s # step one code line

n # step one code line, but not goes inside function called

si # single instruction step

ni # single instruction step, without goinh inside function called

In machine language, when a function is called it's argument are passed into specific registers. $RDI always hold first argument value for function, same as $RSI second argument value and third value are stored at $RDX register. If we are calling any syscall then $RAX register will hold syscall number (e.g. 0 for read).

Now as we can see in out disassemble code of main function it's first called function are decodepassword, which seams suspicious to me. Also we can see that $RAX register moves it's value to $RDI register just before function call, that means $RDI are used as buffer to store some value. To find that what value are stored inside $RDI after function called we use step commands to came control flow of execution to main+55 then read register using these commands:

memory read $rdi

As we can see that $rdi address value are SuperSecure, this seams like a password, then I try this and access granted!!

Some other commands I used while analyzing binary:

settings set target.x86-disassembly-flavor intel

target stop-hook add

di -p -c 10

register read

Thank You!!!