Hacking (Reverse engineering): Gaining access with wrong password

In this post, I will quickly show how you can use a debugger to hack poorly written or packaged code. More specifically, how to enter a wrong password but still get access. Before proceeding, I should be clear, that this is just a demonstration, and the programs out there in production (these days) will definitely not vulnerable to this method (if it is, then it is a shitty program). This is to demonstrate how you can change the execution path as you wish.

First I will show a simple code which prompts for a password to be set, then encrypts it using MD5 sum hash and salt and stores the hash in a file. Then it asks for the same password, reads the hash from the stored file and compares if the two entered passwords are same or not. Then I will show how to reverse engineer the executable file and enter the wrong password, but still make it think that we the correct password was entered. Continue reading “Hacking (Reverse engineering): Gaining access with wrong password”

C Q&A #6: An interesting difference between the C and C++ conditional operator

int main (void)
{
  int a = 5, b = 10, c;

  c = a > 3 ? b = 5 : a = 3;
  printf ("%d %d %d\n", a, b, c);
  //cout << a << " " << b << " " << c << endl;
  
  return 0;
}

Have a look at the above code, what will be the outcome if the code was in C language and if in C++ Language (replace with printf with cout)?

Directly going to the solution. Compilation error for C, and works perfect (no warnings) with C++. I saw this problem is a C question and answer book which didn’t bother to explain, so here is the explanation. Continue reading “C Q&A #6: An interesting difference between the C and C++ conditional operator”

C LANGUAGE UERS! Y U NO SEE STANDARDS!

C LANGUAGE USERS! Y U NO SEE STANDARDS!
C LANGUAGE USERS!
Y U NO SEE STANDARDS!

I had to make this. There are people who give a damn to the standards and follow the stone age Turbo C 3.1 compiler, run programs compiled by it. In the cases for compiler dependent and undefined behaviours, they try to guess in some way why the output was like that and get into a conclusion. Continue reading “C LANGUAGE UERS! Y U NO SEE STANDARDS!”

Dynamically allocating 2d array with adjacent rows in memory

In a previous post “Allocating multidimentional array at runtime in C” I have explained a technique to allocate multidimensional arrays on runtime. While playing around with OpenMPI, I came to know that while sending/receiving a buffer, it requires the elements of a 2d matrix (or any dimension) to be in adjacent. Basically it does not care what you send, or receive, what it cares is the number of elements to be send should be adjacent to one another. In the previous post, the process will allocate the 2d or n-d matrix, but the rows of the matrix may not be adjacent to each other, as each row was allocated separately with malloc and then inserted into another array of pointers, each of which location points to the base addresses of these memory block. Read the post for details.

In C language the 2d array/matrix are stored in a row-major order, that is the elements of the matrix are stored adjacent to each other in the memory row wise. The first row comes first then just after the first row the second row starts, and so on. In the previous method the rows of the matrix may be scattered throughout the memory, as they are allocated with seperate malloc calls, but each of these returned addresses to the memory blocks (used as rows) are assigned to another array of pointers, which holds the rows together, and allows the mat[i][j] syntax to work.

For the applications in which, we might need to allocate the matrix dynamically at runtime, also have the rows of the matrix requires to be adjacent in the memory, and also make the mat[i][j] syntax work can be fulfilled by the following approach.
Continue reading “Dynamically allocating 2d array with adjacent rows in memory”

Journey of a simple recursive code

Some one asked the following question in StackOverflow

Implement a function with prototype char *repeat(char *s, int n) so that it creates and returns a string which consists of n repetitions of the input string s. For example: if the input is “Hello” and 3, the output is “HelloHelloHello”. Use only recursive constructs.

I immediately started compiling the answer as it was a pretty straight forward question. But it was not only me who was posting the answer. So after posting, very quickly other answers started appearing. It was a general everyday answer, until a person (who also answered the question) pointed out a bug in my code. Bugs disturb the mind. So I dug into the code and fixed it. The things started to get challenging when others started to get more compact code, which didn’t let me sit idle.
Continue reading “Journey of a simple recursive code”

Detect Endianness of a System

In a previous post “Little and Big Endian conversion” i have briefly discussed about the Big-Endian and the Little-Endian representations. It is the ordering of the bytes (elementary addressable elements) within the representation of a larger basic data type. These are the two byte orderings in the memory within a larger datatype. For example if the size of integer is 4 bytes in a system, then will the least significant byte be stored in the lower memory address or in the higher memory address. In short: if the most significant byte is stored in higher memory address then it is called the Little Endian representation, and if the most significant byte is stored in lower memory address than the least significant byte then it is called the Big-Endian representation. For a diagram see the post “Little and Big Endian conversion”. Also refer the Wikipedia Entry on Endianness.

So how to determine if your system a Little Endian system or a Big Endian system by running a piece of code? Continue reading “Detect Endianness of a System”

C Q&A #3: When ((x == x + 5) && (y != y)) is true.

The post heading gives an expression which is a contradiction and not possible. In general yes it is a contradiction, but can you write a code such that the below code prints “Hello World.” ?

/* Add source code in the following code such that "Hello World." is printed. */

#include <stdio.h>
#include <math.h>

int main (void)
{

  if (x == x + 5)
  {
    printf ("Hello ");
  }
  if (y != y)
  {
    printf ("World.\n");
  }

  return 0;
}

Continue reading “C Q&A #3: When ((x == x + 5) && (y != y)) is true.”

Get sorted index orderting of an array

Yesterday i was translating some code i wrote in R to C++. I had some calculation to do which required the list of index of the top n values in a list. Therefore what i needed was not a the list sorted itself or get a sorted copy of a given list, but actually the sorted order of the index into the actual array. To describe the problem, for example consider the following list:

arr = 20 50 40 80 10

The sorted (non-decreasing) ordering of the values is obviously

sorted_arr = 10 20 40 50 80

The sorted (non-decreasing) ordering of the index into the original array is (index starts at 1 in this example)

sorted_index_into_arr = 5 1 3 2 4

Therefore the smallest value in the list arr could be found by indexing into arr using the first value of sorted_index_into_arr, which stores the index of the array arr holding the smallest value.

arr[ sorted_index_into_arr[1] ]

The sorted index ordering is very easy to get in languages like R and Octave or Matlab. For example in R we can do the following to get the sorted index order using the order function:

> arr <- c (20, 50, 40, 80, 10)
> arr
[1] 20 50 40 80 10
> order (arr)
[1] 5 1 3 2 4

In the case of Octave or Matlab you can get the index order using the sort function, which will return two lists (1xn matrix), the first list is the sorted array itself, and the next one is the sorted index order into the original array.

octave:1> a = [20 50 40 80 10]
a =

   20   50   40   80   10

octave:2> [sorted index] = sort (a)
sorted =

   10   20   40   50   80

index =

   5   1   3   2   4

Although these functional languages provides gives these features in C/C++ it is not immediately available using the builtin sort library functions. But the sorting routines accepts a function pointer to a comparison function, writing appropriate code for which will do the trick.
Continue reading “Get sorted index orderting of an array”