How is a binary executable organized? Let's explore it (2014) • Hacker News Board

Re: How is a binary executable organized? Let's explore it (2014)

#91

Post by vitiral » Sun, Feb 04, 2024, 1:48 PM UTC

actionfromafar wrote: post #54

vitiral wrote: post #49

Earlier quoted context omitted.

I may have misunderstood, but I'm pretty sure APE is not a "binary format" per se. It is a script that can be executed on any system. That script can then LOAD a binary. IIRC the original needed to decode it from base64 before it could be loaded. So... it's an executable binary loader

Same same, but different… How can the syscalls work the same in linux, windows and n my macos?! It’s bananas

They don't. APE loads a different syscall table depending on the platform. Or something like that, I don't claim to fully understand the internals

Re: How is a binary executable organized? Let's explore it (2014)

#92

Post by trealira » Sun, Feb 04, 2024, 10:43 PM UTC

dilyevsky wrote: post #14

actionfromafar wrote: post #11

Earlier quoted context omitted.

Can you elaborate?

If you put something like if mySecretPassword == "Qwerty123" { ... then "Qwerty123" will be easily seen by strings utility. Which is pretty obvious but I'm guessing some junior folks will be surprised.

You probably know this, but in C, if you wrote the comparison like this

  if (password[0] == 'Q'
   && password[1] == 'w'
   /* the rest of the letters... */
   && password[8] == '3'
   // C strings are 0 terminated
   && password[9] == '\0')
  {
      ...
  }

It will probably compile to something like this on x86-64, assuming a "password" is a pointer held in RDI (although I didn't look at a compiler's output):

  cmp byte [rdi], 0x51 ; 'Q'
  jne false
  ;; the rest of the letters...
  cmp byte [rdi + 9], 0x0 ; '\0'
  jne false

The benefit is that the strings utility wouldn't see the string "Qwerty123" anywhere in the binary.

Unicode and bounds checking code probably complicate this generated assembly in other languages.

It would be nice if there were some way to write a macro or an inline function so that you could write a comparison like

  if inlineStringEqualP(mySecretPassword, "Qwerty123") {
    ...

And then it would expand into something like the assembly I wrote above, so that way, the string literal "Qwerty123" isn't embedded in the final binary executable anywhere. I bet it's possible with C++ templates somehow, but it would be messy.

Re: How is a binary executable organized? Let's explore it (2014)

#93

Post by dilyevsky » Sat, Feb 10, 2024, 4:02 PM UTC

trealira wrote: post #92

dilyevsky wrote: post #14

Earlier quoted context omitted.

If you put something like if mySecretPassword == "Qwerty123" { ... then "Qwerty123" will be easily seen by strings utility. Which is pretty obvious but I'm guessing some junior folks will be surprised.

You probably know this, but in C, if you wrote the comparison like this if (password[0] == 'Q' && password[1] == 'w' /* the rest of the letters... */ && password[8] == '3' // C strings are 0 terminated && password[9] == '\0') { ... } It will probably compile to something like this on x86-64, assuming a "password" is a pointer held in RDI (although I didn't look at a compiler's output): cmp byte [rdi], 0x51 ; 'Q' jne…

I think that was the very first crackmes i ever solved =)