Lab 2 - Hash Collisions Galore

This is an old revision of the document!

Lab 2 - Hash Collisions Galore

Upon its first execution the L2 binary asks the user to generate 1024 passwords. With this information we can assume than the password is not directly hardcoded in the binary but will be processed and compared against a reference value and that this process will process at least 1024 passwords to this value.

Lab 2 output

Using this assumption we can assume that the binary computes a hash of the given password and check it against a reference hash. Moreover due to the need to provide multiple passwords, we can assume that this hash function is weak against collitions.

Lab 2 hash function The first step is to use IDA to disassemble the L2 binary. This gives us a symbolic representation of the program's code. After analysis of the general program flow, we can see that the program looks for the presence of a single argument which we can assume is the user-supplied password. The program then checks the password (pictured left) and prints a message if the password matches an expected input.