Reverse Engineering “Good Kitty” CrackMe

In this write-up I’m going to solve the good kitty crackme. The objective is to discover the right password, and so the message “good kitty!” is written on stdout. Otherwise “bad kitty!” is shown instead, as in the print below.

run_1

I opened the binary in IDA to start static analysis and get an overview of the implementation and trying to figure out ways to discover the password. At first, there is a relatively long section of code that I’m not interested in understanding, so to avoid distractions I looked for the block where the password is read, hopping for a concrete clue.

foo bar

As you can see in the graph, the first block calls _read, which stores the user input in the buffer located at rsp+0x60, with a length of 64 bytes. After that, the execution flow doesn’t return, so I plan to write a symbolic-execution script (with angr) to solve the remaining code. For angr script to start into the middle of the binary, I need to set up the stack data that is required afterward. To do this, I run gdb and collect the necessary values, for example, rsp+0xb.

1
import angr
2
import claripy
3

4
def main():
5
    proj = angr.Project(
6
            'good-kitty',
7
            auto_load_libs=False,
8
            main_opts={
9
                "base_addr": 0x555555554000
10
            }
11
        )
12

13
    chars = [claripy.BVS('char_%d' % i, 8) for i in range(64)]
14
    input_arg = claripy.Concat(*chars)
15

16
    state = proj.factory.blank_state(addr=0x555555555539)
17

18
    for k in chars:
19
        state.solver.add(k < 0x7f)
20
        state.solver.add(k > 0x20)
21

22
    STACK_BASE = 0x7fffffffdc80
23
    STACK_SIZE = 0x1000
24

25
    state.memory.map_region(
26
        STACK_BASE - STACK_SIZE,
27
        STACK_SIZE,
28
        7
29
    )
30

31
    state.regs.rsp = STACK_BASE
32
    state.regs.rax = claripy.BVS("rax", 64)
33

34
    state.memory.store(
35
        state.regs.rsp + 0xb,
36
        claripy.BVV(1, 8)
37
    )
38
    state.memory.store(
39
        state.regs.rsp + 0xc,
40
        claripy.BVV(0, 32)
41
    )
42
    state.memory.store(
43
        state.regs.rsp + 0x60,
44
        input_arg
45
    )
46
    state.memory.store(
47
        state.regs.rsp + 0x10,
48
        b"00sGo4M0passwordenter the right password\x00"
49
    )
50

51
    sm = proj.factory.simulation_manager(state)
52
    sm.explore( find=lambda s: b"good kitty!" in s.posix.dumps(1), avoid=lambda s: b"bad kitty!" in s.posix.dumps(1) )
53

54
    if sm.found:
55
        input_value = sm.found[0].solver.eval(input_arg, cast_to=bytes)
56
        print(f"{input_value}")
57
    else:
58
        print("Bad kitty!")
59

60
if __name__ == "__main__":
61
    main()

At execute this script, the right password “00sGo4M0” is shown and the crackme is solved. You can find the binary and script in my github repository.

run_2 run_3