Linux cracking How to crack in Linux without a disassembler	Not Assigned
26th October 1998	by adq
	Courtesy of Fravia's page of reverse engineering
fra_00xx 98xxxx handle 1100 NA PC	Well, well: adq is back with a Linux reversing essay that will surely be welcome among the rapidly growing community of Linux users among my readers (I wonder how comes that noone that made the 'great sprung' and went from windoze to Linux, happened to go back to Windoze :-) As a matter of fact many good reversers are (almost) not publishing essays any more because they have lost any interest whatsoever in windozed targets... in fact -as you should know- if you'r seriously working (and not just playing with a mouse) you can work in Linux QUICKER, BETTER, and with a greater efficacity... I guess that the last one of my readers remaining in windoze will have soon to turn the lights off in an empty room... you don't believe me? Look better around you: see Micro$oft's building over there? Getting dark isn't it? That's because there are less and less people behind its windows... :-)
	There is a crack, a crack in everything That's how the light gets in
Rating	( )Beginner (x)Intermediate ( )Advanced ( )Expert

First of all, write a demo program, called timetest:

                   #include <stdio.h>

                   #include <time.h>



                   int main(int argc, char* argv[])

                   {

                     time_t curTime;

                     struct tm *curTimeDecoded;



                     time(&curTime);

                     curTimeDecoded = localtime(&curTime);

                  

                     if (curTimeDecoded->tm_year > 95)

                       printf("Too late\n");

                     else

                       printf("In time\n");

                   }

                 

                         gcc -o timetest timetest.c

                 

On linux, there is another, much easier way. Edit a new file, this time called "time.c", and put the following in it: called "time.c", and put the following in it:

                   #include <time.h>

                   #include <stdio.h>



                   time_t time(time_t* tp)

                   {

                     printf("haha\n");

                   

                     return(2000);

                   }

                 

This time, compile it as follows:

                         gcc -c time.c -o time.o

                         ld -shared -o time.so time.o

                 

Now, to fix the program, type "export LD_PRELOAD=./time.so". This instructs the linux runtime linker (ld.so* or ld-linux.so*) to look in this library for functions before consulting the normal system libraries, when it is attempting to satisfy the program's dependencies.

Run the program, and it will print "haha", followed by "In time", no matter what the system time is. Be warned though... since you exported LD_PRELOAD, this will affect every program in your current shell until you either unset LD_PRELOAD, or exit the shell.

However, there is a slight problem. If you only want to fiddle the times on certain occasions, but use the normal time() call on others, you cannot simply call time() - that will call yourself and you will end up with a nasty recursive loop. The way I got round this was by finding the import table in the ELF binary, and changing the name of the function it imports from "time" to something like "Xime". Then, I wrote my own version of Xime, which is obviously then free to call the real time() function, since we haven't overridden it. This can all be done within emacs, using normal text search & replace. There is probably a better way to do this though.

Final Notes

I wish windows could do this :)

Ob Duh

homepage links search_forms +ORC students' essays academy database
reality cracking how to search javascript wars
tools anonymity academy cocktails antismut CGI-scripts mail_fravia+
Is reverse engineering legal?