Binary patching ... in Mac OS X

Time and time again, we came across binary-only executables doing things against our likings. Like asking for registration number to use it, or open it. With no viable replacement solution or no source code, it turns out that we are left with only one option and that to patch the binary to override some of it's functionality to make it work as per our likings. 

In other words, most of the bad programs these days comes in binary-only version. With no source code available it gets very frustrating when we are forced to use programs, which are so obviously wrong, but which can not be fixed and rebuilt. But there is a very simple way available where you need to flip few bits of the program to solve the issue on hand.

  

Remember the last time you had to patch a binary program to make it work as per your liking? Don't worry, I'll show you how to patch a binary on Mac OS X.

Lets first write our own test program. Here it is...[remember, this is just a sample program ;-)]

#include

int verify(char* cUser, char* cPass)

{

        if(cUser != NULL && cPass != NULL)

        {

                if(strcmp(cPass, "Test") == 0)

                        return 1;

                else

                        return 0;

        }

}

int main(int argc, char* argv[])

{

        char cUser[8];

        char cPass[8];

        printf("User:");

        scanf("%s", cUser);

        printf("\nPass:");

        scanf("%s", cPass);

        if(verify(cUser, cPass))

        {

                printf("\nWelcome %s\n", cUser);

        }

        else

        {

                printf("\nTry again!\n");

        }

        return 0;

}

Lets build it using gcc. 

nightrover:test administrator$ gcc -o test test.c

Run the test program...Lets see how does it behave when different passwords are supplied.  

nightrover:test administrator$ ./test 

User:Username

Pass:password <-- wrong password, should give "Try again!" message

Try again! <-- as expected! 

nightrover:test administrator$ 

Now lets try correct password (since we have source code, we know the correct password is "Test"). As mentioned in the beginning, great deal of these binaries do not come with source codes. 

nightrover:test administrator$ ./test 

User:Username

Pass:Test <-- wrong password, should give "Try again" message

Welcome Username <-- as expected! correct user/pass authorized you!

nightrover:test administrator$ 

But now what if we don't have source of this binary and we don't have correct password to login? As mentioned in the beginning, a great deal of these binaries come without source code.  

We need to scan the binary (test.o) through the microscope - in our case a disassembler program can do this for us. We are going to use the "gdb". We need to learn a bit about the executable "gcc" has made beforehand. "otool" can be used to find address and offset for our text segment from the binary.

nightrover:test administrator$ otool -l test

Load command 0

cmd LC_SEGMENT

[...]

Section

  sectname __text

   segname __TEXT

      addr 0x00001e60

      size 0x00000172

    offset 3680

     align 2^2 (4)

    reloff 0

    nreloc 0

     flags 0x80000400

 reserved1 0

 reserved2 0

To find out the in memory address of the instruction where the condition is checked, we will have to run our binary inside "gdb". We choose to break at "verify" function - because it is the "verify" function which we are going to disassemble.

nightrover:test administrator$ gdb --arch i386 test

GNU gdb 6.3.50-20050815 (Apple version gdb-768) (Tue Oct  2 04:07:49 UTC 2007)

Copyright 2004 Free Software Foundation, Inc.

GDB is free software, covered by the GNU General Public License, and you are

welcome to change it and/or distribute copies of it under certain conditions.

Type "show copying" to see the conditions.

There is absolutely no warranty for GDB.  Type "show warranty" for details.

This GDB was configured as "i386-apple-darwin"...Reading symbols for shared libraries ... done

(gdb) break verify

Breakpoint 1 at 0x1ec8

(gdb) break main

Breakpoint 2 at 0x1f3d

Note: setting a breakpoint in the verify() function will halt the program's execution and let us step through the code one line at a time. A breakpoint can be set either by specifying the name of the function or a line number.

(gdb) run

Note: now if we run the program, it will stop at the begining of verify() and wait for further instructions.

 

Starting program: /Users/administrator/test/test 

Reading symbols for shared libraries ++. done

Breakpoint 2, 0x00001f3d in main ()

(gdb) bt

#0  0x00001f3d in main ()

(gdb) next

Single stepping until exit from function main, 

which has no line number information.

User:Pallav

Pass:Text

Breakpoint 1, 0x00001ec8 in verify ()

(gdb) bt

#0  0x00001ec8 in verify ()

#1  0x00001f9e in main ()

(gdb) f 0

#0  0x00001ec8 in verify ()

(gdb) disass

Dump of assembler code for function verify:

0x00001ec2 : push   %ebp

0x00001ec3 : mov    %esp,%ebp

0x00001ec5 : push   %edi

0x00001ec6 : push   %esi

0x00001ec7 : push   %ebx

0x00001ec8 : sub    $0x2c,%esp

0x00001ecb : call   0x1ed0

0x00001ed0 : pop    %ebx

0x00001ed1 : cmpl   $0x0,0x8(%ebp)

0x00001ed5 : je     0x1f2c

0x00001ed7 : cmpl   $0x0,0xc(%ebp)

0x00001edb : je     0x1f2c

0x00001edd : mov    0xc(%ebp),%eax

0x00001ee0 : lea    0x102(%ebx),%edx

0x00001ee6 : mov    %eax,-0x24(%ebp)

0x00001ee9 : mov    %edx,-0x28(%ebp)

0x00001eec : movl   $0x5,-0x2c(%ebp)

0x00001ef3 : cld    

0x00001ef4 : mov    -0x24(%ebp),%esi

0x00001ef7 : mov    -0x28(%ebp),%edi

0x00001efa : mov    -0x2c(%ebp),%ecx

0x00001efd : repz cmpsb %es:(%edi),%ds:(%esi)

0x00001eff : mov    $0x0,%eax

0x00001f04 : je     0x1f10

0x00001f06 : movzbl -0x1(%esi),%eax

0x00001f0a : movzbl -0x1(%edi),%ecx

0x00001f0e : sub    %ecx,%eax

0x00001f10 : test   %eax,%eax

0x00001f12 : jne    0x1f23

0x00001f14 : movl   $0x1,-0x1c(%ebp)

0x00001f1b : mov    -0x1c(%ebp),%eax

0x00001f1e : mov    %eax,-0x20(%ebp)

0x00001f21 : jmp    0x1f2e

0x00001f23 : movl   $0x0,-0x1c(%ebp)

0x00001f2a :jmp    0x1f1b

0x00001f2c :jmp    0x1f2e

0x00001f2e :mov    -0x20(%ebp),%eax

0x00001f31 :add    $0x2c,%esp

0x00001f34 :pop    %ebx

0x00001f35 :pop    %esi

0x00001f36 :pop    %edi

0x00001f37 :leave  

0x00001f38 :ret    

End of assembler dump.

(gdb) 

We need to figure out the offset for our jne conditional expression in the binary.

offset_in_file = address_in_memory - address_in_text_section + offset_in_text_section

offset_in_file = 0x00001F12 - 0x00001E60 + 3680

offset_in_file = 0x00000F12

We will use the "xxd" to get a hex dump of our binary.

nightrover:test administrator$ xxd ./test > test.hex

[...]

0000f00: 0000 0000 740a 0fb6 46ff 0fb6 4fff 29c8  ....t...F...O.).

0000f10: 85c0 750f c745 e401 0000 008b 45e4 8945  ..u..E......E..E

0000f20: e0eb 0bc7 45e4 0000 0000 ebef eb00 8b45  ....E..........E

[...]

If we look at the disassembled code, we know we have a very easy condition to bypass. There are so many different ways we could fix it: changing the return value of the verify function, forcing the zero flag to be clear at the conditional jump, overwriting the jump with NOPs, etc. The main challenge is to make it with the least amount of bytes changed. After considering different alternatives, I opted for a quite a simple method of flipping the conditional jump instruction. To do so, we need to change the instruction at offset 0x0000f12 from 75 (JNE) to 74 (JE). This single byte change to flip the conditional instruction lead us to...

[...]

0000f00: 0000 0000 740a 0fb6 46ff 0fb6 4fff 29c8  ....t...F...O.).

0000f10: 85c0 740f c745 e401 0000 008b 45e4 8945  ..u..E......E..E

0000f20: e0eb 0bc7 45e4 0000 0000 ebef eb00 8b45  ....E..........E

[...]

With the fix in hand, we need to recreate the binary from the altered xxd file. We will also have to set the executable bit set to let OS know that the file is executable. 

nightrover:test administrator$ xxd -r test.hex > testpatched

nightrover:test administrator$ chmod +x testpatched

nightrover:test administrator$ ./testpatched

Now, lets run the patched binary...

nightrover:test administrator$ ./testpatched 

User:nightrover

Pass:password <-- wrong password, should give "Try again" message

Welcome nightrover <-- even wrong password allowed you to login! Voila!

nightrover:test administrator$ 

It was very quick and painless solution. It may not be as good as having the real source of the application to be fixed, but in the real world it solved the problem. Our goal was to solve the problem, wasn't it?