5 ms·

Julia's articles are always excellent. I've always had great results teaching people that compiled code doesn't keep secrets by demoing `strings`.

actionfromafar 3y ago
Can you elaborate?
- shzhdbi09gv8ioi 3y ago
  man strings
- dilyevsky 3y ago
  If you put something like if mySecretPassword == "Qwerty123" { ... then "Qwerty123" will be easily seen by strings utility. Which is pretty obvious but I'm guessing some junior folks will be surprised.
  - trealira 3y ago
    You probably know this, but in C, if you wrote the comparison like this if (password[0] == 'Q' && password[1] == 'w' /* the rest of the letters... */ && password[8] == '3' // C strings are 0 terminated && password[9] == '\0') { ... } It will probably compile to something like this on x86-64, assuming a "password" is a pointer held in RDI (although I didn't look at a compiler's output): cmp byte [rdi], 0x51 ; 'Q' jne false ;; the rest of the letters... cmp byte [rdi + 9], 0x0 ; '\0' jne false The benefit is that the strings utility wouldn't see the string "Qwerty123" anywhere in the binary. Unicode and bounds checking code probably complicate this generated assembly in other languages. It would be nice if there were some way to write a macro or an inline function so that you could write a comparison like if inlineStringEqualP(mySecretPassword, "Qwerty123") { ... And then it would expand into something like the assembly I wrote above, so that way, the string literal "Qwerty123" isn't embedded in the final binary executable anywhere. I bet it's possible with C++ templates somehow, but it would be messy.
    - dilyevsky 3y ago
      I think that was the very first crackmes i ever solved =)
- xutopia 3y ago
  You can run the `strings` command on most executables (or PDFs) and get an output of the strings represented in the file. Of course you can obfuscate some of those strings if you do things right but a lot of people who don't know about `strings` could write a password protected feature in a compile bit of code and be embarrassed to see how easy it is to find out what the password is.
- zerotolerance 3y ago
  The other replies are pretty good. You can find all sorts of goodies in string data inside a binary: hostnames, URL fragments, error messages or templates, credentials. Pretty much any string constants that a program might use.
  - versteegen 3y ago
    It's even quite interesting to run strings on programs I wrote and I do it regularly. For example it can be faster to get the version string from an .exe using strings if you know what to grep for than to run "wine program.exe --version".
sva_ 3y ago
Explain that to the German judges that fined some poor fella for finding passwords in a binary by [doing the equivalent of] running strings on it. They claim he 'circumvented' the software's 'security measures'. https://www.theregister.com/2024/01/19/germany_fine_security/ https://www.theregister.com/2024/01/19/germany_fine_security...

actionfromafar 3y ago

Can you elaborate?

shzhdbi09gv8ioi 3y ago
man strings
dilyevsky 3y ago
If you put something like if mySecretPassword == "Qwerty123" { ... then "Qwerty123" will be easily seen by strings utility. Which is pretty obvious but I'm guessing some junior folks will be surprised.
- trealira 3y ago
  You probably know this, but in C, if you wrote the comparison like this if (password[0] == 'Q' && password[1] == 'w' /* the rest of the letters... */ && password[8] == '3' // C strings are 0 terminated && password[9] == '\0') { ... } It will probably compile to something like this on x86-64, assuming a "password" is a pointer held in RDI (although I didn't look at a compiler's output): cmp byte [rdi], 0x51 ; 'Q' jne false ;; the rest of the letters... cmp byte [rdi + 9], 0x0 ; '\0' jne false The benefit is that the strings utility wouldn't see the string "Qwerty123" anywhere in the binary. Unicode and bounds checking code probably complicate this generated assembly in other languages. It would be nice if there were some way to write a macro or an inline function so that you could write a comparison like if inlineStringEqualP(mySecretPassword, "Qwerty123") { ... And then it would expand into something like the assembly I wrote above, so that way, the string literal "Qwerty123" isn't embedded in the final binary executable anywhere. I bet it's possible with C++ templates somehow, but it would be messy.
  - dilyevsky 3y ago
    I think that was the very first crackmes i ever solved =)
xutopia 3y ago
You can run the `strings` command on most executables (or PDFs) and get an output of the strings represented in the file. Of course you can obfuscate some of those strings if you do things right but a lot of people who don't know about `strings` could write a password protected feature in a compile bit of code and be embarrassed to see how easy it is to find out what the password is.
zerotolerance 3y ago
The other replies are pretty good. You can find all sorts of goodies in string data inside a binary: hostnames, URL fragments, error messages or templates, credentials. Pretty much any string constants that a program might use.
- versteegen 3y ago
  It's even quite interesting to run strings on programs I wrote and I do it regularly. For example it can be faster to get the version string from an .exe using strings if you know what to grep for than to run "wine program.exe --version".

sva_ 3y ago

Explain that to the German judges that fined some poor fella for finding passwords in a binary by [doing the equivalent of] running strings on it. They claim he 'circumvented' the software's 'security measures'. https://www.theregister.com/2024/01/19/germany_fine_security/ https://www.theregister.com/2024/01/19/germany_fine_security...