Recent Posts

: Programming : Life : Economics :

2013-10-29 07.27.37

How To: Shove data into Postgres using Goroutines(Gophers) and GoLang

After watching Rob Pike’s wonderful golang talk, ‘Concurrency Is Not Parallelism’, in which he uses the analogy of having many Gophers running around and getting work done. I realized that I wanted to program a test so as better to solidify the concept.

Rob Pike – ‘Concurrency Is Not Parallelism’

Recently a pain point for me while using Play! and Scala was finding a fast way to insert data into a Postgres Database. My solution was fine but I felt it could be simpler, nay I would even say that ideally it SHOULD be simpler. I decided to see how golang would handle this type of problem.

Please install golang 1.2 and postgres 9.3.1 on a 10.9 OSX machine.

We will then create a database with one table.

$ initdb ~/Programming/postgres-E utf8
$ pg_ctl -D ~/Programming/postgres -l ~/logfile start
$ createdb testdb
$ psql testdb
testdb=# create table test ( gopher_id int, created timestamp );

Next, create a file called test_one.go with my provided code.. Our goal right now is to simply get data to insert into the database. I should mention that I planned to have many goroutines (or as Rob says, gophers) inserting data into my testdb so the column gopher_id was in preparation for this.

package main
 
import (
  //"os"
  "log"
  "time"
  "fmt"
  "database/sql"
  _ "github.com/lib/pq"
)
 
func main() {
  // create the statement string
  var sStmt string = "insert into test (gopher_id, created) values ($1, $2)"
 
  // lazily open db (doesn't truly open until first request)
  db, err := sql.Open("postgres","host=localhost dbname=testdb sslmode=disable")
  if err != nil {
    log.Fatal(err)
  }
 
  stmt, err := db.Prepare(sStmt)
  if err != nil {
    log.Fatal(err)
  }
 
  fmt.Printf("StartTime: %v\n", time.Now())
 
  res, err := stmt.Exec(1, time.Now())
  if err != nil || res == nil {
    log.Fatal(err)
  }
 
  // close statement
  stmt.Close()
 
  // close db
  db.Close()
 
  fmt.Printf("StopTime: %v\n", time.Now())
}

Run it and take a look at the results.

$ go build test_one.go 
$ ./test_one 
StartTime: 2013-10-28 19:37:11.014548615 -0700 PDT
StopTime: 2013-10-28 19:37:11.01744029 -0700 PDT
$

Yay! We have inserted exactly one row into the database.

Lets modify our program to insert a 100,000 rows using a simple for loop.

package main
 
import (
  "os"
  "log"
  "time"
  "fmt"
  "database/sql"
  _ "github.com/lib/pq"
)
 
func main() {
  // create the statement string
  var sStmt string = "insert into test (gopher_id, created) values ($1, $2)"
  var entries int = 100000
 
  // lazily open db (doesn't truly open until first request)
  db, err := sql.Open("postgres","host=localhost dbname=testdb sslmode=disable")
  if err != nil {
    log.Fatal(err)
  }
 
  fmt.Printf("StartTime: %v\n", time.Now())
  for i := 0; i < entries; i++ {
 
    stmt, err := db.Prepare(sStmt)
    if err != nil {
      log.Fatal(err)
    }
 
    res, err := stmt.Exec(1, time.Now())
    if err != nil || res == nil {
      log.Fatal(err)
    }
 
    // close statement
    stmt.Close()
  }
 
  // close db
  db.Close()
 
  fmt.Printf("StopTime: %v\n", time.Now())
  os.Exit(0)
}

And the results after running it.

$ ./test_one 
StartTime: 2013-10-28 19:53:55.397246856 -0700 PDT
StopTime: 2013-10-28 19:54:30.471278797 -0700 PDT
$

Ok. It took 35 seconds to insert a simple timestamp 100,000 times.

Now here is where we want to mix things up a bit. Rob mentions this thing called a goroutine in his talk. What would happen if we used 10 goroutines to insert 10,000 records each. It should be faster right?

Here is my test_many.go application, copy it.

package main
 
// schema we can use along with some select statements
// create table test ( gopher_id int, created timestamp );
// select * from test order by created asc limit 1;
// select * from test order by created desc limit 1;
// select count(created) from test;
 
import (
  "log"
  "time"
  "fmt"
  "database/sql"
  _ "github.com/lib/pq"
)
 
const (
  gophers = 10
  entries = 10000
)
 
func main() {
 
  // create string to pass
  var sStmt string = "insert into test (gopher_id, created) values ($1, $2)"
 
  // run the insert function using 10 go routines
  for i := 0; i < gophers; i++ {
    // spin up a gopher
    go gopher(i, sStmt)
  }
 
  // this is a simple way to keep a program open
  // the go program will close when a key is pressed
  var input string
  fmt.Scanln(&input)
}
 
func gopher(gopher_id int, sStmt string) {
 
  // lazily open db (doesn't truly open until first request)
  db, err := sql.Open("postgres","host=localhost dbname=testdb sslmode=disable")
  if err != nil {
    log.Fatal(err)
  }
 
  fmt.Printf("Gopher Id: %v || StartTime: %v\n",gopher_id, time.Now())
 
  for i := 0; i < entries; i++ {
 
    stmt, err := db.Prepare(sStmt)
    if err != nil {
      log.Fatal(err)
    }
 
    res, err := stmt.Exec(gopher_id, time.Now())
    if err != nil || res == nil {
      log.Fatal(err)
    }
 
    stmt.Close()
 
  }
  // close db
  db.Close()
 
  fmt.Printf("Gopher Id: %v || StopTime: %v\n",gopher_id, time.Now())
 
}

Compile and run it. And here are the results.

$ go build test_many.go
$ ./test_many 
Gopher Id: 0 || StartTime: 2013-10-28 20:33:22.756366002 -0700 PDT
Gopher Id: 1 || StartTime: 2013-10-28 20:33:22.756647643 -0700 PDT
Gopher Id: 2 || StartTime: 2013-10-28 20:33:22.756794146 -0700 PDT
Gopher Id: 3 || StartTime: 2013-10-28 20:33:22.756918631 -0700 PDT
Gopher Id: 4 || StartTime: 2013-10-28 20:33:22.757068214 -0700 PDT
Gopher Id: 5 || StartTime: 2013-10-28 20:33:22.757215735 -0700 PDT
Gopher Id: 6 || StartTime: 2013-10-28 20:33:22.757371258 -0700 PDT
Gopher Id: 7 || StartTime: 2013-10-28 20:33:22.757492378 -0700 PDT
Gopher Id: 8 || StartTime: 2013-10-28 20:33:22.757640434 -0700 PDT
Gopher Id: 9 || StartTime: 2013-10-28 20:33:22.758553529 -0700 PDT
Gopher Id: 5 || StopTime: 2013-10-28 20:33:31.466897188 -0700 PDT
Gopher Id: 7 || StopTime: 2013-10-28 20:33:31.473265074 -0700 PDT
Gopher Id: 0 || StopTime: 2013-10-28 20:33:31.475096903 -0700 PDT
Gopher Id: 4 || StopTime: 2013-10-28 20:33:31.485587389 -0700 PDT
Gopher Id: 6 || StopTime: 2013-10-28 20:33:31.500614304 -0700 PDT
Gopher Id: 3 || StopTime: 2013-10-28 20:33:31.5006651 -0700 PDT
Gopher Id: 8 || StopTime: 2013-10-28 20:33:31.501664917 -0700 PDT
Gopher Id: 1 || StopTime: 2013-10-28 20:33:31.510199788 -0700 PDT
Gopher Id: 2 || StopTime: 2013-10-28 20:33:31.522350833 -0700 PDT
Gopher Id: 9 || StopTime: 2013-10-28 20:33:31.523710669 -0700 PDT
 
$

Nice! Roughly 9 seconds for 100,000 records.

Lets change our test_many.go application to insert 1,000,000 records. Simply as a way to keep the application running longer.

...snip...
 
const (
  gophers = 10
  entries = 100000
)
 
...snip...

Now go ahead and build the application and run it.

Then in another terminal window, open up top and search for the test_many command.

PID    COMMAND      %CPU TIME     #TH   #WQ  #PORT #MREGS MEM    RPRVT  PURG   CMPRS  VPRVT  VSIZE  PGRP  PPID  STATE    UID       FAULTS    COW     MSGSENT    MSGRECV
89478  test_many    0.0  00:12.39 15    0    84    1448   140M   139M   0B     0B     358M   139G   89478 88263 sleeping 672251097 36630     95      110        51

You will see that under the #TH column that our application, test_many, has 15 threads open. 10 of these, are the threads we created using our goroutine. 

UPDATE: That statement was not true. I’ve learned after working with go that while using goroutines, threads are dynamically assigned. It is not a 1 to 1 correlation.

However, Rob does have a talk where he mentions some more details. At minute 8:56 he writes

“But if you think of it as a very cheap thread, you won’t be far off”

 

Anyway, this is the section of the test_many.go file where the magic happens.

...snip...
 
  for i := 0; i < gophers; i++ {
    // spin up a gopher
    go gopher(i, sStmt)
  }
 
...snip...

You see, simply by placing the “go” call in front of our gopher function, we allow golang to do a bunch of behind the scenes awesomeness. A part of this gain, is an inexpensive and versatile thread and memory manager. This is pretty sweet.

As the last test, here is 20 gophers inserting a million rows into our database.

Change the needed constants.

...snip...
 
const (
  gophers = 20
  entries = 50000
)
 
...snip...

Then recompile and run our application.

$ ./test_many 
Gopher Id: 0 || StartTime: 2013-10-30 14:40:51.619452739 -0700 PDT
Gopher Id: 1 || StartTime: 2013-10-30 14:40:51.619757831 -0700 PDT
Gopher Id: 2 || StartTime: 2013-10-30 14:40:51.619896348 -0700 PDT
Gopher Id: 3 || StartTime: 2013-10-30 14:40:51.620059076 -0700 PDT
Gopher Id: 4 || StartTime: 2013-10-30 14:40:51.620283647 -0700 PDT
Gopher Id: 5 || StartTime: 2013-10-30 14:40:51.620410941 -0700 PDT
Gopher Id: 6 || StartTime: 2013-10-30 14:40:51.620550967 -0700 PDT
Gopher Id: 7 || StartTime: 2013-10-30 14:40:51.620693553 -0700 PDT
Gopher Id: 8 || StartTime: 2013-10-30 14:40:51.62085492 -0700 PDT
Gopher Id: 9 || StartTime: 2013-10-30 14:40:51.62177397 -0700 PDT
Gopher Id: 10 || StartTime: 2013-10-30 14:40:51.621900208 -0700 PDT
Gopher Id: 11 || StartTime: 2013-10-30 14:40:51.622068806 -0700 PDT
Gopher Id: 12 || StartTime: 2013-10-30 14:40:51.622233856 -0700 PDT
Gopher Id: 13 || StartTime: 2013-10-30 14:40:51.622374732 -0700 PDT
Gopher Id: 14 || StartTime: 2013-10-30 14:40:51.622520823 -0700 PDT
Gopher Id: 15 || StartTime: 2013-10-30 14:40:51.622663899 -0700 PDT
Gopher Id: 16 || StartTime: 2013-10-30 14:40:51.6228063 -0700 PDT
Gopher Id: 17 || StartTime: 2013-10-30 14:40:51.62294893 -0700 PDT
Gopher Id: 18 || StartTime: 2013-10-30 14:40:51.623085432 -0700 PDT
Gopher Id: 19 || StartTime: 2013-10-30 14:40:51.623231574 -0700 PDT
Gopher Id: 3 || StopTime: 2013-10-30 14:42:35.551828109 -0700 PDT
Gopher Id: 6 || StopTime: 2013-10-30 14:42:35.619763694 -0700 PDT
Gopher Id: 17 || StopTime: 2013-10-30 14:42:35.642630072 -0700 PDT
Gopher Id: 4 || StopTime: 2013-10-30 14:42:35.660139502 -0700 PDT
Gopher Id: 10 || StopTime: 2013-10-30 14:42:35.67527849 -0700 PDT
Gopher Id: 13 || StopTime: 2013-10-30 14:42:35.685175774 -0700 PDT
Gopher Id: 9 || StopTime: 2013-10-30 14:42:35.69144017 -0700 PDT
Gopher Id: 0 || StopTime: 2013-10-30 14:42:35.729137844 -0700 PDT
Gopher Id: 1 || StopTime: 2013-10-30 14:42:35.749108884 -0700 PDT
Gopher Id: 2 || StopTime: 2013-10-30 14:42:35.770752277 -0700 PDT
Gopher Id: 7 || StopTime: 2013-10-30 14:42:35.777471603 -0700 PDT
Gopher Id: 8 || StopTime: 2013-10-30 14:42:35.780713859 -0700 PDT
Gopher Id: 19 || StopTime: 2013-10-30 14:42:35.783338736 -0700 PDT
Gopher Id: 11 || StopTime: 2013-10-30 14:42:35.794922546 -0700 PDT
Gopher Id: 14 || StopTime: 2013-10-30 14:42:35.799124142 -0700 PDT
Gopher Id: 5 || StopTime: 2013-10-30 14:42:35.800538715 -0700 PDT
Gopher Id: 12 || StopTime: 2013-10-30 14:42:35.802006822 -0700 PDT
Gopher Id: 18 || StopTime: 2013-10-30 14:42:35.806211023 -0700 PDT
Gopher Id: 16 || StopTime: 2013-10-30 14:42:35.817042445 -0700 PDT
Gopher Id: 15 || StopTime: 2013-10-30 14:42:35.824304999 -0700 PDT

With a tiny golang program, we now have 1 million writes taking 1 minute and 44 seconds. Friggin sweet.

UPDATE2: Thanks to corvinusz for pointing this out. By simply moving our prepare request outside of our for loop. We can now insert 1M records in 44 seconds. Thanks dude!

 
...snip...
 
func gopher(gopher_id int, sStmt string) {
 
  // lazily open db (doesn't truly open until first request)
  db, err := sql.Open("postgres","host=localhost dbname=testdb sslmode=disable")
  if err != nil {
    log.Fatal(err)
  }
 
  stmt, err := db.Prepare(sStmt)
  if err != nil {
    log.Fatal(err)
  }
 
  fmt.Printf("Gopher Id: %v \t|| StartTime: %v\n",gopher_id, time.Now())
 
 
  for i := 0; i < entries; i++ {
 
 
    res, err := stmt.Exec(gopher_id, time.Now())
    if err != nil || res == nil {
      log.Fatal(err)
    }
 
 
  }
 
  stmt.Close()
  // close db
  db.Close()
 
  fmt.Printf("Gopher Id: %v \t|| StopTime: %v\n",gopher_id, time.Now())
 
}
 
...snip...
$ ./test_many_pool 
Gopher Id: 8 	|| StartTime: 2013-10-31 08:52:45.56084829 -0700 PDT
Gopher Id: 6 	|| StartTime: 2013-10-31 08:52:45.561137992 -0700 PDT
Gopher Id: 12 	|| StartTime: 2013-10-31 08:52:45.561215818 -0700 PDT
Gopher Id: 4 	|| StartTime: 2013-10-31 08:52:45.561288387 -0700 PDT
Gopher Id: 7 	|| StartTime: 2013-10-31 08:52:45.56135501 -0700 PDT
Gopher Id: 15 	|| StartTime: 2013-10-31 08:52:45.56148435 -0700 PDT
Gopher Id: 2 	|| StartTime: 2013-10-31 08:52:45.562015828 -0700 PDT
Gopher Id: 17 	|| StartTime: 2013-10-31 08:52:45.562434107 -0700 PDT
Gopher Id: 13 	|| StartTime: 2013-10-31 08:52:45.562872507 -0700 PDT
Gopher Id: 19 	|| StartTime: 2013-10-31 08:52:45.564599961 -0700 PDT
Gopher Id: 0 	|| StartTime: 2013-10-31 08:52:45.567561345 -0700 PDT
Gopher Id: 1 	|| StartTime: 2013-10-31 08:52:45.568002729 -0700 PDT
Gopher Id: 3 	|| StartTime: 2013-10-31 08:52:45.568259325 -0700 PDT
Gopher Id: 10 	|| StartTime: 2013-10-31 08:52:45.569216209 -0700 PDT
Gopher Id: 9 	|| StartTime: 2013-10-31 08:52:45.569317516 -0700 PDT
Gopher Id: 11 	|| StartTime: 2013-10-31 08:52:45.569604124 -0700 PDT
Gopher Id: 14 	|| StartTime: 2013-10-31 08:52:45.572600335 -0700 PDT
Gopher Id: 16 	|| StartTime: 2013-10-31 08:52:45.574639425 -0700 PDT
Gopher Id: 18 	|| StartTime: 2013-10-31 08:52:45.576122518 -0700 PDT
Gopher Id: 5 	|| StartTime: 2013-10-31 08:52:45.577174648 -0700 PDT
Gopher Id: 5 	|| StopTime: 2013-10-31 08:53:28.156243751 -0700 PDT
Gopher Id: 14 	|| StopTime: 2013-10-31 08:53:28.240175919 -0700 PDT
Gopher Id: 9 	|| StopTime: 2013-10-31 08:53:28.247910193 -0700 PDT
Gopher Id: 1 	|| StopTime: 2013-10-31 08:53:28.313724365 -0700 PDT
Gopher Id: 10 	|| StopTime: 2013-10-31 08:53:28.372717602 -0700 PDT
Gopher Id: 16 	|| StopTime: 2013-10-31 08:53:28.389852733 -0700 PDT
Gopher Id: 15 	|| StopTime: 2013-10-31 08:53:28.434203629 -0700 PDT
Gopher Id: 19 	|| StopTime: 2013-10-31 08:53:28.470070067 -0700 PDT
Gopher Id: 18 	|| StopTime: 2013-10-31 08:53:28.486355611 -0700 PDT
Gopher Id: 4 	|| StopTime: 2013-10-31 08:53:28.505530435 -0700 PDT
Gopher Id: 8 	|| StopTime: 2013-10-31 08:53:28.507830911 -0700 PDT
Gopher Id: 3 	|| StopTime: 2013-10-31 08:53:28.520788665 -0700 PDT
Gopher Id: 11 	|| StopTime: 2013-10-31 08:53:28.545292303 -0700 PDT
Gopher Id: 13 	|| StopTime: 2013-10-31 08:53:28.585376452 -0700 PDT
Gopher Id: 0 	|| StopTime: 2013-10-31 08:53:28.587530913 -0700 PDT
Gopher Id: 7 	|| StopTime: 2013-10-31 08:53:28.598791481 -0700 PDT
Gopher Id: 2 	|| StopTime: 2013-10-31 08:53:28.605832957 -0700 PDT
Gopher Id: 12 	|| StopTime: 2013-10-31 08:53:28.61655187 -0700 PDT
Gopher Id: 17 	|| StopTime: 2013-10-31 08:53:28.616684023 -0700 PDT
Gopher Id: 6 	|| StopTime: 2013-10-31 08:53:28.618116313 -0700 PDT

Something to call out, is that we are shoving our data, basically, into a black hole. We have no idea if the inserts completed successfully. Yes there is some error logic, but not enough. We are using Go to have our application function in a parallel state, or as Rob might say.

“The concurrent composition of 10 gophers inserting data into a database”

 

Rob in his talk, goes on to mention channels. Which is the logical next step for message passing here. This would bring our application into a concurrent state and if people are interested, hit me up @jaredfolkins and let me know I should post more concerning this.

play_postgres

Play Framework 2.2 and Postgres 9.3.1 java.sql.SQLException: No suitable driver found

Environment

OSX: 10.9
Postgres: 9.3.1
Scala: 2.10.3
PlayFramework: 2.2
Java: 1.7.0_25

build.sbt

...
 
libraryDependencies ++= Seq(
  jdbc,
  anorm,
  cache,
  "org.postgresql" % "postgresql" % "9.2-1003-jdbc4"
)
 
...

application.conf

...
 
db.default.driver=org.postgresql.Driver
db.default.url="jdbc:postgresql://localhost/YOURDATABASENAMEHERE"
 
...

 

Stop/Start your play application and you should be good to go.

twos-compliment_thankstwo

Hacking Java Bytecode for Programmers (Part4) – Krakatau And The Case Of The Integer Overflow

Posted on June 25, 2013

Index

Hacking Java Bytecode for Programmers (Part1) – The Birds and the Bees of Hex Editing
Hacking Java Bytecode for Programmers (Part2) – Lions, and Tigers, and OP Codes, OH MY!
Hacking Java Bytecode for Programmers (Part3) – Yes, disassemble with Javap ALL OVER THE PLACE!
Hacking Java Bytecode for Programmers (Part4) – Krakatau And The Case Of The Integer Overflow

Introduction

A funny thing happened on the way to crafting my next blog post. I met this very talented twenty-one year old student who goes by the handle Storyyeller, on an online forum. He offered to help educate me on how to write bytecode by hand. How freaking pro.

Along the way, Storyyeller mentioned Krakatau. Software that he is actively writing to help with the assembling and disassembling of Java class files. He also sent me a link to a command line application he had written. This application is a puzzle. To solve it, you must hack it. Which gave me the idea that for this article, we are going to reverse engineer Storyyeller’s application. Download the following crackme1.1.jar application now.

As a reminder, please go back and read the other articles if you need to catchup.

CHALLENGE ACCEPTED!

The first thing we will do after downloading the .zip file, is unzip the .zip archive found inside. Then run the program.

thedude$ java -jar crackme1.1.jar 
Please enter a 32bit signed int
thedude$ java -jar crackme1.1.jar 1
Incorrect
thedude$ java -jar crackme1.1.jar -908
Incorrect
thedude$

Storyyeller said, that in order to crack this application, one needs to enter a 32bit integer to get the program to print “Correct”.

Given that rule set, we need to uncompress the .jar file to see what is going on. If you are not aware, a Java .jar file is essentially a zip archive. It is a package/container that holds all the needed binaries and libraries for the application to function, made this way primarily for ease of distribution.

thedude$ unzip crackme1.1.jar
Archive:  crackme1.1.jar
  inflating: META-INF/MANIFEST.MF    
  inflating: Code.class              
  inflating: author.txt              
thedude$

Unzipping the .jar dumps the contents and we can see that there are three files.

  1. The MANIFEST.MF file enclosed in the META-INF directory
  2. The author.txt file
  3. The Code.class binary file

Unlike C, where the main() function is always used to tell the compiler “START THE PROGRAM HERE”, the MANIFEST.MF file found in a .jar archive can be used to specify the program entry point. It can also be used to set the CLASSPATH along with several other parameters. In a large application the information in this file could prove useful, but for us, the .jar contained only a single binary file. Code.class. So it is obvious what binary file we should operate on. (The author.txt file should be self explanatory)

At this point run javap on the Code.class file to see what is dumped.

thedude$ javap -verbose Code.class

The result you will recieve, is rather, well, odd.

xfO9jl

An endless printing of new line characters will be dumped to screen. If we redirect the output to file and wait a while, eventually a  >2GB file will materialize. No bueno.

The initial take away here is that javap can be manipulated. Lets try and figure out how Storyyeller is screwing with our output.

The Hard Way

In order to do this, I ended up writing a script to parse the constant pool of the Code.class file. The two import pieces of information found when parsing the Constant Pool where at index #34 and #35.

Full Output

thedude$ ./dis.py Code.class
Magic			cafebabe
Minor			0
Major			49
ConstantPoolCount	38
 
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	1		0xa		10		01	17	6a
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	2		0x1e		30		01	6	64
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	3		0x27		39		01	39	28
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	4		0x51		81		01	8	69
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	5		0x5c		92		01	3	28
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	6		0x62		98		01	8	43
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	7		0x6d		109		01	9	49
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	8		0x79		121		01	31	50
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	9		0x9b		155		01	16	6a
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	10		0xae		174		01	3	6f
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	11		0xb4		180		01	21	4c
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	12		0xcc		204		01	19	6a
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	13		0xe2		226		01	7	70
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	14		0xec		236		01	21	28
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	15		0x104		260		01	4	43
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	16		0x10b		267		01	4	6d
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	17		0x112		274		01	22	28
}
CONSTANT_Class_info {
	pool_index	hex_offset	byte_offset	tag	name_index	
	18		0x12b		299		07	1
}
CONSTANT_Class_info {
	pool_index	hex_offset	byte_offset	tag	name_index	
	19		0x12e		302		07	9
}
CONSTANT_Class_info {
	pool_index	hex_offset	byte_offset	tag	name_index	
	20		0x131		305		07	12
}
CONSTANT_Class_info {
	pool_index	hex_offset	byte_offset	tag	name_index	
	21		0x134		308		07	15
}
CONSTANT_NameAndType_info {
	pool_index	hex_offset	byte_offset	tag	name_index	descriptor_index
	22		0x137		311		0c	0002		0003
}
CONSTANT_NameAndType_info {
	pool_index	hex_offset	byte_offset	tag	name_index	descriptor_index
	23		0x13c		316		0c	0004		0005
}
CONSTANT_NameAndType_info {
	pool_index	hex_offset	byte_offset	tag	name_index	descriptor_index
	24		0x141		321		0c	000a		000b
}
CONSTANT_NameAndType_info {
	pool_index	hex_offset	byte_offset	tag	name_index	descriptor_index
	25		0x146		326		0c	000d		000e
}
CONSTANT_Methodref_info { 
	pool_index	hex_offset	byte_offset	tag	class_index	name_and_type_index
	26		0x14b		331		0a	0012		0016
}
CONSTANT_Methodref_info { 
	pool_index	hex_offset	byte_offset	tag	class_index	name_and_type_index
	27		0x150		336		0a	0012		0017
}
CONSTANT_Methodref_info { 
	pool_index	hex_offset	byte_offset	tag	class_index	name_and_type_index
	28		0x155		341		0a	0014		0019
}
CONSTANT_Fieldref_info {
	pool_index	hex_offset	byte_offset	tag	class_index	name_and_type_index
	29		0x15a		346		09	0013		0018
}
CONSTANT_String_info {
	pool_index	hex_offset	byte_offset	tag	string_index
	30		0x15f		351		08	0006
}
CONSTANT_String_info {
	pool_index	hex_offset	byte_offset	tag	string_index
	31		0x162		354		08	0007
}
CONSTANT_String_info {
	pool_index	hex_offset	byte_offset	tag	string_index
	32		0x165		357		08	0008
}
CONSTANT_Integer_info {
	pool_index	hex_offset	byte_offset	tag	bytes		int_value
	33		0x168		360		03	668f182d	1720653869
}
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	34		0x16d		365		01	65535	0a
}
CONSTANT_Class_info {
	pool_index	hex_offset	byte_offset	tag	name_index	
	35		0x1016f		65903		07	34
}
CONSTANT_NameAndType_info {
	pool_index	hex_offset	byte_offset	tag	name_index	descriptor_index
	36		0x10172		65906		0c	0022		000b
}
CONSTANT_Fieldref_info {
	pool_index	hex_offset	byte_offset	tag	class_index	name_and_type_index
	37		0x10177		65911		09	0023		0024
}
thedude$
CONSTANT_Utf8_info { 
	pool_index	hex_offset	byte_offset	tag	length	bytes
	34		0x16d		365		01	65535	0a
}
CONSTANT_Class_info {
	pool_index	hex_offset	byte_offset	tag	name_index	
	35		0x1016f		65903		07	34
}

We can see that a Utf8 string resides at index #34 in the constant pool. It’s length, in bytes, is 65535. A long string can easily indicate obfuscation. Lets make the string smaller.

Open the Code.class file with Bless and go to offset 0x16d.

0x16dSince we are in the Constant Pool portion of the binary file, 01 is the correct tag for a CONSTANT_Utf8 string.

The two bytes following the tag are the strings length. Converting FF FF to decimal gives us the value 65535. This again helps confirm that we are in the correct location of the file.

Lets find the end of the string by searching for the offset 0x1016f.

UPDATE: People have asked how I knew to go to offset 0x1016f. When I parsed the Contant Pool with my script, the output shows the beginning byte of every member in the Constant Pool. Since I knew where #34 and #35 started, I could just go to the start of #35 (0x1016f) and move back one byte to get to the end of index #34.

0x1016f

Again, still being inside the Constant Pool, we know that 07 is the tag for a CONSTANT_Class. Which if we look at the output from my script, we know to be located at index #35.

CONSTANT_Class_info {
	pool_index	hex_offset	byte_offset	tag	name_index	
	35		0x1016f		65903		07	34
}

What we are going to do, is manually highlight the hex string and replace it with the Hexadecimal notation for a literal “Space” (\s in programmer speak).

highlight

Delete the large, multi-lined (lots of lines fall off the screen) segment of hexadecimal bytes that we have highlighted and replace it with a single hexadecimal value of 20.

replaced

 We are not finished though, we need to then change FF FF to 00 01 to specify a string length of one.

0001

Make sure the file is saved and then run javap over Code.class again.

...output truncated...
    65514: getstatic     #37                // Field " "." ":Ljava/io/PrintStream;
    65517: getstatic     #37                // Field " "." ":Ljava/io/PrintStream;
    65520: getstatic     #37                // Field " "." ":Ljava/io/PrintStream;
    65523: getstatic     #37                // Field " "." ":Ljava/io/PrintStream;
    65526: getstatic     #37                // Field " "." ":Ljava/io/PrintStream;
    65529: getstatic     #37                // Field " "." ":Ljava/io/PrintStream;
    65532: getstatic     #37                // Field " "." ":Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    51    42   any
}
thedude$

Eureka! Much more usable output and we really can put together a story of what Storyyeller did.

  • First, he created an insanely long string containing 65535 character bytes.
  • Second, he must have manually manipulated the file by hand to include 65532 getstatic references to that crazy long string.

Storyyeller obviously knew that by creating a .class file in such a way, he woud basically make javap dump over 2GB of individual string characters, essentially DOS’ing javap.

 The Krakatau Way

In the previous section, I created a script and then we manipulated the file by hand using Bless. That is a lot of work! There HAS to be an easier way and luckily there is. We can use Krakatau.

First, delete the Code.class file and then unzip crackme1.1.jar again.

thedude$ rm Code.class
thedude$ unzip crackme1.1.jar
Archive:  crackme1.1.jar
replace META-INF/MANIFEST.MF? [y]es, [n]o, [A]ll, [N]one, [r]ename: A
  inflating: META-INF/MANIFEST.MF    
  inflating: Code.class              
  inflating: author.txt              
thedude$

Then, clone Krakatau from github.

thedude$ git clone https://github.com/Storyyeller/Krakatau.git
Cloning into 'Krakatau'...
remote: Counting objects: 1135, done.
remote: Compressing objects: 100% (415/415), done.
remote: Total 1135 (delta 747), reused 1100 (delta 713)
Receiving objects: 100% (1135/1135), 413.12 KiB | 600 KiB/s, done.
Resolving deltas: 100% (747/747), done.
thedude$

Next, disassemble Code.class using Krakatau.

thedude$ python Krakatau/disassemble.py Code.class 
Krakatau  Copyright (C) 2012-13  Robert Grosse
This program is provided as open source under the GNU General Public License. 
See LICENSE.TXT for more details.
 
processing target Code.class, 1/1 remaining
Class written to /home/thedude/krak/Code.j
9.16616106033  seconds elapsed
thedude$

This will create a Code.j file that uses the same assembly manipulation syntax as the Jasmin assembler.

“Jasmin as an assembler takes ASCII descriptions of JVM Classes, written in a simple assembler-like syntax using the Java Virtual Machine instruction set. It converts them into binary JVM Class files, suitable for loading by a Java runtime system.”

Basically, instead of looking at hexadecimal like we did in the previous section, we will now have a file that will be much easier to manipulate.

Open the Code.j file using a text editor (I use vim) and goto line 21871. You’ll see something like this.

.const [_34] = Utf8 '\n   7:\tastore_0\n   8:\ticonst_0\n   9:\taaload\n   10:\tinvokestatic\t#26; //Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;\n   13:\tinvokevirtual\t#27; //Method java/lang/Integer.intValue:()I\n   16:\tbipush\t-27\n   18:\timul\n   19:\tbipush\t39\n   21:\tiadd\n   22:\tldc\t#33; //int 1720653868\n   24:\tif_icmpne\t32\n   27:\tldc\t#30; //String Correct!\n   29:\tgoto\t34\n   32:\tldc\t#31; //String Incorrect\n   34:\tgetstatic\t#29; //Field java/lang/System.out:Ljava/io/PrintStream;\n   37:\tswap\n   38:\tinvokevirtual\t#28; //Method java/io/PrintStream.println:(Ljava/lang/String;)V\n   41:\treturn\n   42:\tpop\n   43:\tldc\t#32; //String Please enter a 32bit signed int\n   45:\tgoto\t34\n   48:\tgetstatic\t#37; //Field www.www:Ljava/io/PrintStream;\n  Exception table:\n   from   to  target type\n     1    51    42   any\n\n}\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\npublic final class Code extends java.io.PrintStream\n  minor version: 0\n  major version: 50\n  Constant pool:\nconst #1 = Asciz\tjava/lang/Integer;\nconst #2 = Asciz\tdecode;\nconst #3 = Asciz\t(Ljava/lang/String;)Ljava/lang/Integer;;\nconst #4 = Asciz\tintValue;\nconst #5 = Asciz\t()I;\nconst #6 = Asciz\tCorrect!;\nconst #7 = Asciz\tIncorrect;\nconst #8 = Asciz\tPlease enter a 32bit signed int;\nconst #9 = Asciz\tjava/lang/System;\nconst #10 = Asciz\tout;\nconst #11 = Asciz\tLjava/io/PrintStream;;\nconst #12 = Asciz\tjava/io/PrintStream;\nconst #13 = Asciz\tprintln;\nconst #14 = Asciz\t(Ljava/lang/String;)V;\nconst #15 = Asciz\tCode;\nconst #16 = Asciz\tmain;\nconst #17 = Asciz\t([Ljava/lang/String;)V;\nconst #18 = class\t#1;\t//  java/lang/Integer\nconst #19 = class\t#9;\t//  java/lang/System\nconst #20 = class\t#12;\t//  java/io/PrintStream\nconst #21 = class\t#15;\t//  Code\nconst #22 = NameAndType\t#2:#3;//  decode:(Ljava/lang/String;)Ljava/lang/Integer;\nconst #23 = NameAndType\t#4:#5;//  intValue:()I\nconst #24 = NameAndType\t#10:#11;//  out:Ljava/io/PrintStream;\nconst #25 = NameAndType\t#13:#14;//  println:(Ljava/lang/String;)V\nconst #26 = Method\t#18.#22;\t//  java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;\nconst #27 = Method\t#18.#23;\t//  java/lang/Integer.intValue:()I\nconst #28 = Method\t#20.#25;\t//  java/io/PrintStream.println:(Ljava/lang/String;)V\nconst #29 = Field\t#19.#24;\t//  java/lang/System.out:Ljava/io/PrintStream;\nconst #30 = String\t#6;\t//  Correct!\nconst #31 = String\t#7;\t//  Incorrect\nconst #32 = String\t#8;\t//  Please enter a 32bit signed int\nconst #33 = int\t1720653869;\nconst #34 = Asciz\twww;\nconst #35 = class\t#34;\t//  www\nconst #36 = NameAndType\t#34:#11;//  www:Ljava/io/PrintStream;\nconst #37 = Field\t#35.#36;\t//  www.www:Ljava/io/PrintStream;\n\n{\npublic static final synchronized void main(java.lang.String[]);\n  Code:\n   Stack=2, Locals=1, Args_size=1\n   0:\taload_0\n   1:\tjsr\t7\n   4:\tgetstatic\t#37; //Field www.www:Ljava/io/PrintStream;\n   7:\tastore_0\n   8:\ticonst_0\n   9:\taaload\n   10:\tinvokestatic\t#26; //Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;\n   13:\tinvokevirtual\t#27; //Method java/lang/Integer.intValue:()I\n   16:\tbipush\t58\n   18:\timul\n   19:\tbipush\t-2\n   21:\tiadd\n   22:\tldc\t#33; //int 172065386\n   24:\tif_icmpne\t32\n   27:\tldc\t#30; //String Correct!\n   29:\tgoto\t34\n   32:\tldc\t#31; //String Incorrect\n   34:\tgetstatic\t#29; //Field java/lang/System.out:Ljava/io/PrintStream;\n   37:\tswap\n   38:\tinvokevirtual\t#28; //Method java/io/PrintStream.println:(Ljava/lang/String;)V\n   41:\treturn\n   42:\tpop\n   43:\tldc\t#32; //String Please enter a 32bit signed int\n   45:\tgoto\t34\n   48:\tgetstatic\t#37; //Field www.www:Ljava/io/PrintStream;\n  Exception table:\n   from   to  target type\n     1    51    42   any\n\n}\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\

I highlighted the text inside the single quotes and replaced that big long string with the word Krakatau.

...file truncated...
        getstatic [_37]
        getstatic [_37]
        getstatic [_37]
        getstatic [_37]
        getstatic [_37]
        getstatic [_37]
        getstatic [_37]
        getstatic [_37]
.end method
 
.const [_34] = Utf8 'Krakatau'
.const [_35] = Class [_34]
.const [_37] = Field [_35] [_34] Ljava/io/PrintStream;

Save the file and use Krakatau to assemble Code.j.

thedude$ python Krakatau/assemble.py Code.j
Krakatau  Copyright (C) 2012-13  Robert Grosse
This program is provided as open source under the GNU General Public License. 
See LICENSE.TXT for more details.
 
Processing file Code.j, 1/1 remaining
Class written to /home/thedude/krak/Code.class
thedude$

Now run javap over our newly created Code.class file.

 65448: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65451: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65454: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65457: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65460: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65463: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65466: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65469: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65472: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65475: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65478: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65481: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65484: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65487: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65490: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65493: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65496: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65499: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65502: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65505: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65508: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65511: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65514: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65517: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65520: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65523: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65526: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65529: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    65532: getstatic     #14                // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    51    42   any
}
thedude$

YES! That output looks very familiar. Except this time around, it only took a couple minutes to get to this point.

Again, use vim or your favorite text editor to open the Code.j file and remove the L51 label and all the getstatic calls beneath it.

Also, on line 9, since we removed the L51 label, we need to respecify the bounds of the method.

FROM

.catch [0] from L1 to L51 using L42

TO

.catch [0] from L1 to L42 using L42

Your entire Code.j file should now look like this.

.version 49 0
.class super final public Code
.super java/io/PrintStream
 
.method static final synchronized public main : ([Ljava/lang/String;)V
        .limit stack 2
        .limit locals 1
        .catch [0] from L1 to L42 using L42
        aload_0
L1:
        jsr L7
        getstatic [_37]
L7:
        astore_0
        iconst_0
        aaload
        invokestatic java/lang/Integer decode (Ljava/lang/String;)Ljava/lang/Integer;
        invokevirtual java/lang/Integer intValue ()I
        bipush -37
        imul
        bipush 42
        iadd
        ldc 1720653869
        if_icmpne L32
        ldc 'Correct!'
        goto L34
L32:
        ldc 'Incorrect'
L34:
        getstatic java/lang/System out Ljava/io/PrintStream;
        swap
        invokevirtual java/io/PrintStream println (Ljava/lang/String;)V
        return
L42:
        pop
        ldc 'Please enter a 32bit signed int'
        goto L34
        getstatic [_37]
.end method
 
.const [_34] = Utf8 'Krakatau'
.const [_35] = Class [_34]
.const [_37] = Field [_35] [_34] Ljava/io/PrintStream;

Assemble our Code.j file using Krakatau.

thedude$ python Krakatau/assemble.py Code.j
Krakatau  Copyright (C) 2012-13  Robert Grosse
This program is provided as open source under the GNU General Public License. 
See LICENSE.TXT for more details.
 
Processing file Code.j, 1/1 remaining
Class written to /home/thedude/krak/Code.class
thedude$

Run javap over the newly created Code.class file.

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

Nice! This output makes much more sense. We can now begin to try and figure out what the required 32bit integer is.

Stepping through the logic

We can easily see that there is a single Main() method.

Expand - Main()

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

On operation 9, we can see the aaload opcode. Indicating it is loading argument[0] onto the stack.

Expand - aaload

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload              10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$
Operation 10 is invoking the method Integer.decode on argument[0].

Expand - Integer.decode

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

Operation 13 is casting the value as an int.

Expand - Integer.intValue

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

This is where things get interesting. Now that argument[0] is cast as an integer an on the stack, at operation 16, you can see Storyyeller used bipush to push integer -37 onto the operand stack.

Expand - bipush

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

He then multiplies the integer we supplied with -37 using imul at operation 18.

Expand - imul

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul                19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

The result is kept on the stack. Storyyeller then pushes the integer 42 at Operation 19, again using bipush, onto the operand stack.

Expand - bipush

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$
Our result along with integer 42 are added using iadd on operation 21.

Expand - iadd

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd                22: ldc           #4                  // int 1720653869
      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

At operation 22 the integer 1720653869 is called onto the stack using ldc and Storyyeller then compares 1720653869 to the result using the if_icmpne at Operation 24.

Expand - ldc

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869      24: if_icmpne     32
      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

If the mathematical result (using our supplied integer) and 1720653869 are NOT equal, jump to operation 32 and print “Incorrect”

ELSE

Print “Correct!”

Expand - if_icmpne

thedude$ javap -c Code.class 
public final class Code extends java.io.PrintStream {
  public static final synchronized void main(java.lang.String[]);
    Code:
       0: aload_0       
       1: jsr           7
       4: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
       7: astore_0      
       8: iconst_0      
       9: aaload        
      10: invokestatic  #20                 // Method java/lang/Integer.decode:(Ljava/lang/String;)Ljava/lang/Integer;
      13: invokevirtual #24                 // Method java/lang/Integer.intValue:()I
      16: bipush        -37
      18: imul          
      19: bipush        42
      21: iadd          
      22: ldc           #4                  // int 1720653869
      24: if_icmpne     32      27: ldc           #2                  // String Correct!
      29: goto          34
      32: ldc           #3                  // String Incorrect
      34: getstatic     #29                 // Field java/lang/System.out:Ljava/io/PrintStream;
      37: swap          
      38: invokevirtual #35                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      41: return        
      42: pop           
      43: ldc           #1                  // String Please enter a 32bit signed int
      45: goto          34
      48: getstatic     #14                 // Field Krakatau.Krakatau:Ljava/io/PrintStream;
    Exception table:
       from    to  target type
           1    42    42   any
}
thedude$

Use The Mathz Luke

At this point, we could express the value we need to derive with the following equation.

x(-37) – 42 = 1720653869

Obviously we need to solve for x. Which begs the question.

What 32 bit number could we enter into Storyyeller’s application in order for it to eventually equal 1720653869?

Using the following equation, should yield our answer.

(1720653869/-37) – 42 = x

But instead, we find that x is an not an integer and is irreducible.

-1720652315/37 (irreducible)

WTH?

Idea

It is at this point where one should realize that Storyyeller has royally screwed with us. The given problem is not solvable in the traditional sense. Which means that we need to get more creative.

  • We know Storyyeller is trying to have us solve for 1720653869.
  • We know that he is vetting that argument[0] is 32 bit integer.
  • We also know he isn’t validating that the result of x(-37) + 42 is a 32bit integer.

Hopefully his cli application is open to a integer overflow exploit.

Integer Overflow

1100110100011110001100000101101 is the binary representation of 1720653869 but Storyyeller isn’t validating the bitness. What this means, is that we can trick the application into misinterpreting the result of Storyyeller’s initial equation x(-37) + 42 for our favor.

“WAT?” you ask.

I feel you. It really is kind of confusing at first. Have a look at this.

answer      	x           	overflow	binary                               
1720653869.0	-46504157.4865	        	      1100110100011110001100000101101
  • The Answer column is the value Storyyeller is trying to have us solve for
  • The X column is the result returned after x/-37 – 42 is applied
  • The Overflow column is any binary digits that could potentially overflow and fall off
  • The Binary column is the actually binary representation of the number in column X

One way to test our hypothesis, is to continually add 2^31 to our answer as that is the amount of bits in a 32 bit system. Like a clock or safe, we will continue to flip the bits until either we run out of targetable 32bit numbers or we find our answer.

(NOTE: Ordinarily you would use some modular arithmetic to solve this. But I’m going to use a show/do methodolgy to hopefully make more sense on what actually happens under the hood when an integer overflows)

The first time we add 2^31 we get the following.

answer      	x           	overflow	binary                               
1720653869.0	-46504157.4865	        	      1100110100011110001100000101101
3868137517.0	-104544256.081	       1	     11100110100011110001100000101101

Essentially we just added 1 bit to the end of the binary number (dont forget the end is on the left). You can see that the overflow column reminds us that there is 1 overflow bit and that in that space, we have assigned a binary “1″. Again, X is what we are trying to solve for, it needs to be a 32bit integer. -104544256.081 obviously isn’t as we can see it has a remainder.

So lets do it again by adding 2^31.

answer      	x           	overflow	binary                               
1720653869.0	-46504157.4865	        	      1100110100011110001100000101101
3868137517.0	-104544256.081	       1	     11100110100011110001100000101101
6015621165.0	-162584354.676	      10	    101100110100011110001100000101101

Still no luck. Lets use some code to print a bunch of values for us to analyze.

Integer Overflow Code

# We know Storyyeller is evaluating that our input, after multiplication and addition, equals 1720653869
# So the following expression should help articulate trying to solve for x
# x(-37) + 42 = 1720653869
# Love Love Love WolframAlpha
# http://www.wolframalpha.com/input/?i=x%28-37%29+*+42+%3D+1720653869
 
import re
import math
 
def getOverflow(original, derivative):
        needle = str(bin(original))[2:] + "$"
        haystack = str(bin(int(derivative)))[2:]
        overflow = re.sub(needle, '', haystack)
        return overflow
 
def calcAnswer(answer):
        # 2 ^ 31
        bit_offset = 2147483648
        # start the sequence at zero
        answer_sequence = 0
        #bit_ceiling = 2147483648
        #bit_floor = (bit_offset * -1) + 1
        print
        print "%s\t%s\t%s\t%s" % ('answer'.ljust(12),'x'.ljust(12),'overflow'.ljust(8),'binary'.ljust(37))
        while True:
 
                if(answer_sequence == 0):
                        # if 0 assign the answer with no offset
                        answer_sequence = float(answer)
                else:
                        # else add in the offset to flip the binary bit
                        answer_sequence = float(answer_sequence) + float(bit_offset)
 
                x = (answer_sequence - 42) / -37
                overflow = getOverflow(answer,answer_sequence)
                binary = str(bin(int(answer_sequence)))[2:]
                print "%s\t%s\t%s\t%s" % (answer_sequence,x, overflow.rjust(8),binary.rjust(37))
                # must be rational
                # if we wanted more logic, we could add a check to validate bitness 
                # and break if the bitness grew past 32bit.
                if(int(x) == float(x)):
                        print "The solution is %s" % int(x)
                        break
 
        print
calcAnswer(1720653869)

And if we run it.

thedude$ python mathz.py 
answer      	x           	overflow	binary                               
1720653869.0	-46504157.4865	        	      1100110100011110001100000101101
3868137517.0	-104544256.081	       1	     11100110100011110001100000101101
6015621165.0	-162584354.676	      10	    101100110100011110001100000101101
8163104813.0	-220624453.27	      11	    111100110100011110001100000101101
10310588461.0	-278664551.865	     100	   1001100110100011110001100000101101
12458072109.0	-336704650.459	     101	   1011100110100011110001100000101101
14605555757.0	-394744749.054	     110	   1101100110100011110001100000101101
16753039405.0	-452784847.649	     111	   1111100110100011110001100000101101
18900523053.0	-510824946.243	    1000	  10001100110100011110001100000101101
21048006701.0	-568865044.838	    1001	  10011100110100011110001100000101101
23195490349.0	-626905143.432	    1010	  10101100110100011110001100000101101
25342973997.0	-684945242.027	    1011	  10111100110100011110001100000101101
27490457645.0	-742985340.622	    1100	  11001100110100011110001100000101101
29637941293.0	-801025439.216	    1101	  11011100110100011110001100000101101
31785424941.0	-859065537.811	    1110	  11101100110100011110001100000101101
33932908589.0	-917105636.405	    1111	  11111100110100011110001100000101101
36080392237.0	-975145735.0	   10000	 100001100110100011110001100000101101
The solution is -975145735
thedude$

We can see that the script has found a hit on -975145375 which suddenly means that -975145375(-37) + 42 = 1720653869.

“No it doesn’t Jared!” you say.

And you are correct.

-975145735*-37 + 42 = 36080392237

But here is where the overflow comes in.

By design, Storyyeller purposely doesn’t validate the bitness of the result before he evaluates it against 1720653869. He has given us the opportunity to allow the binary bits to overflow. Any extraneous bits that can’t be used in a 32bit system simply are NOT accounted for.

answer      	x           	overflow	binary                               
1720653869.0	-46504157.4865	        	      1100110100011110001100000101101
36080392237.0	-975145735.0	   10000	 100001100110100011110001100000101101

Which means the five bits in the overflow column, 1-0-0-0-0, overflow and drop off.

Basically converting 36080392237 into 1720653869.

Or their binary equivalents.

(10000)1100110100011110001100000101101 into 1100110100011110001100000101101.

Test the answer now against Storyyeller’s application.

thedude$ java -jar crackme1.1.jar -975145735
Correct!
thedude$

Success!!!

Conclusion

You should now know how to further exploit bytecode by hand along with slapping around the constant pool a bit. You should realize that doing such things by hand is insanely tedious. You should understand how to install and utilize Krakatau. And you should be aware and comprehend what Integer Overflow is and hopefully now go and investigate ideas on how to prevent your applications from suffering them.

Thanks again to Storyyeller for not only writing Krakatau but also crafting the crackme. I know it takes a lot of effort and it is much appreciated.

Older Posts