Learned about CE as a kid, failed at doing the tutorial series abysmally. Decided to try it out again...
| Steps | Password |
|---|---|
| Step 2 | 090453 |
| Step 3 | 419482 |
| Step 4 | 890124 |
| Step 5 | 888899 |
| Step 6 | 098712 |
| Step 7 | 013370 |
| Step 8 | 525927 |
| Step 9 | 31337157 |
eax, ebx, ecx and so on are actually registers, which can be seen as "hardware" variables, meaning different than higher level-language's variables. Registers can be used in your software directly with instructions such as mov, add or cmp. The leading e means extended that is your register is 32 bits wide. On the other hand, 64-bits registers begin by r.
These registers are not all used the same purposes as illustrated below. This graphic show the register usage for Linux 64-bit ABI.
All registers are not described in this capture though. For instance *ip is a special register (process counter) that holds the next instruction to bo executed.
You can find the full ABI there. Some information is specific to Linux but most remains relevant for any POSIX-compliant system.
- 32-bit - The x64 code injection technique does not work and throws a float exception. I instead found the pointers for Group 1's health values then set the value to 1 million and froze the value. This worked and the next button became clickable.
- 64-bit - The code injection technique works here. Find the health value of Dave, find what writes to the address, on the instruction -
Find out what addresses this instruction accessesthen compare the structures and find the unique values for each team and it's offset. Create a script comparing the values of the team-id and jump the instruction for group-1 that decreases the health. See folder - Step 9
