# 08 - leg

## The Challenge

Daddy told me I should study arm. But I prefer to study my leg!

Download: <http://pwnable.kr/bin/leg.c>

Download: <http://pwnable.kr/bin/leg.asm>

ssh <leg@pwnable.kr> -p2222 (pw:guest)

## The Solution

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH1gaRcz2FL7euASEfP%2F-MH1i3-OnMtUO15t-Kuq%2Fimage.png?alt=media\&token=360ea4b6-038e-4ab4-ae64-5ac864302b3a)

Our input needs to equal to the sum of the three key functions.

To solve this one some knowledge of ARM Assembly is required.

### Key1

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH1gaRcz2FL7euASEfP%2F-MH1iilBcbl5fHcWY2CL%2Fimage.png?alt=media\&token=d6bc71ec-63d4-4bf6-a469-b4fdaf107fac)

The return value of **key1** will be the value of `pc` at `0x00008cdc`, which is **`0x00008ce4`**. Yes, `pc` points two commands ahead.

### key2

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH1gaRcz2FL7euASEfP%2F-MH1m6slxe-9nJIiv-iQ%2Fimage.png?alt=media\&token=c7b7250a-2ddf-4ef4-85e2-3bc334a00700)

`r3` contains the value of `pc` at `0x00008d08`  plus 4, which is `0x00008d0c`. It is poped onto `pc` at`0x00008d0a`, but doesn't change the execution flow as it is the address of the next instruction. Later on the value of `r3` is used as the return value.

### key3

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH1gaRcz2FL7euASEfP%2F-MH1nDWyJQfRJgQs9EAE%2Fimage.png?alt=media\&token=3b04cf1c-c5bc-48a1-a610-b9cf780d865d)

The return value here is the value of `lr`, which is the return address of the function. That be:

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH1gaRcz2FL7euASEfP%2F-MH1o0rVvlxLuUM7-IaP%2Fimage.png?alt=media\&token=3a5b27e1-2cb2-455d-9eed-557b09c1e751)

### Final Input

The solution is the addition of these three values in decimal representation.
