import json import r2pipe from contextlib import redirect_stdout import io

app = "r2con.2020.CrackMe"

print(f"Launching the app: {app}") r2f = r2pipe.open(f"frida://spawn/usb//{app}")

print("Loading bypass1.js") r2f.cmd("\. bypass1.js; \dc")

r2f.cmd("e anal.nopskip = false") r2f.cmd(".\init") r2f.cmd(".\ii*") r2f.cmd(".\is*")

0x102e685fc s -[FirstViewController getPassphrase]

offset_output = r2f.cmd("\is~getPass") getpass_offset = offset_output.split(" ")[0]

print("Creating passcode string on the heap")

Stick the string passcode on the heap

string_ptr = r2f.cmd("\dmas passcode")

print("Replacing the returned string of getPassphrase")

Replace the return value of the getPassphrase function with our string

r2f.cmd(f"\dis {getpass_offset} {string_ptr}")

print("Bypassing challenge 2") r2f.cmd("s \dm~CrackMe~r-x:0[0]") r2f.cmd(".\e/") opcodes = r2f.cmd("pa svc 0x80") svc_hits = r2f.cmd(f"\/x {opcodes}")

for s in svc_hits.split("\n"): s_hit = s.split(" ")[0] if "0x" in s_hit: print(f"nop and trace syscall @ {s_hit}") r2f.cmd(f"wao nop @ {s_hit}") r2f.cmd(f"\dtr $$ x0 @ {s_hit}")

input("Press any key to exit...")