xodump post

Author: TheFozl

_posts/Misc/2025-07-11-xodump.md

@@ -0,0 +1,114 @@
+---
+title: Dumping Non-Readable ELF Binaries with xodump, a practical example
+author: Fozl
+categories: [Misc]
+date: 2025-07-11
+description: Reading an executable-only ELF binary with xodump.
+tags: 
+  - xodump
+  - elf
+  - ctf
+  - reverse
+image:
+  path: /assets/img/Misc/misc.png
+---
+
+## Dumping a Non-Readable ELF Binary with xodump
+
+Sometimes, especially in CTFs or hardened environments, you get an ELF binary that is executable but not readable:
+
+```bash
+sonic@pc:~$ ls -lsah crackme
+16K -rwx--x--x 1 root root 16K Jul 11 18:11 crackme
+````
+
+When executed:
+
+```bash
+sonic@pc:~$ ./crackme
+Enter password: eggman
+Wrong password!
+```
+
+You cannot open it, copy it, or run any static analysis directly.
+
+Solution: use [xodump](https://github.com/StroppaFR/xodump).
+
+---
+
+## Method
+
+1. **Compile xodump** (on the target if you have a compiler, otherwise compile elsewhere and upload):
+
+   ```bash
+   git clone https://github.com/StroppaFR/xodump.git
+   cd xodump
+   make
+   ```
+
+2. **Dump the memory-mapped binary:**
+
+   ```bash
+   ./xodump crackme > out
+   will try to dump mapped executable /home/sonic/crackme
+   dumping memory mapping from 0x555555554000 to 0x555555555000
+   ...
+   successfully dumped 0x5000 bytes from mapped executable /home/sonic/crackme
+   child process exited correctly after dump
+   ```
+
+3. **Analyze the dump:**
+
+   ```bash
+   strings out
+   ```
+
+   Immediately you get the password string used in the binary:
+
+   ```
+   Enter password:
+   GottaGoFast
+   Good password!
+   Wrong password!
+   ```
+
+Of course, in real use, you'll load `out` into IDA or Ghidra, and the binaries won't be a simple crackme.
+
+---
+
+## Notes
+
+* This only works if you can execute the binary. If you do not trust the binary, do not run it.
+* Works even with setuid binaries.
+* All credits to [nikost](https://github.com/StroppaFR) for xodump, which improves on the old [XOcopy](http://reverse.lostrealm.com/tools/xocopy.html).
+
+---
+
+## Example crackme used:
+
+```c
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main() {
+    char password[20];
+    printf("Enter password: ");
+    fgets(password, 20, stdin);
+    if (strcmp(password, "GottaGoFast\n") == 0) {
+        printf("Good password!\n");
+    } else {
+        printf("Wrong password!\n");
+    }
+    return 0;
+}
+```
+
+---
+
+## TL;DR
+
+* If you can execute an ELF binary, you can dump it from memory with xodump, even if it is not readable.
+* Useful for CTF, pentest, any situation with “execute-only” binaries.
+
+---