jpl1337/binary-exploitation

Proof of concept binary patching/exploitation... just me playing around

binary-exploitation

Proof of concept binary patching/exploitation... just me playing around. I used BinaryNinja because it's what I'm most comfortable using at the moment, but my current goal is to switch to Ghidra.

The opensesame.c is the original C code used, the other two files are the subsequent patches. The "opensesame_patch1_all_pass" binary will say almost any password is correct. The "opensesame_patch2_no_pass_needed" binary doesn't even require a password to say it's correct.

The first patch changed the JNE 73A to JE 73A, in other words flipping the output of the compare statement. This gives the correct output for any input but the correct input. If I wanted to be more throrough I guess I could've changed what the input was being compared to also, so that any password including the actual correct password would give the correct result.

The second patch changed JNE 748 to JMP 72C. This causes the code to jump straight to the part of the code that gives the correct output, completly bypassing the check for input and the subsequent comparison.