I'll jump to challenge #30, the #29 is an obfuscated one, and I'll need more time to work on that. The #30 is a simple one and is in the format of finding the password. For the disassembly of this program I'll use Ida, from the one I've tried is honestly the more user-friendly.
Analysis
Let's analyze the main thread only, here is the code associated with it
; int __cdecl main(int, char **, char **) main proc near ; DATA XREF: start+17↑o ; __unwind { push ebp mov ebp, esp and esp, 0FFFFFFF0h sub esp, 0A0h mov eax, large gs:14h mov [esp+9Ch], eax xor eax, eax mov dword ptr [esp], offset aEnterPassword ; "enter password:" 1st argument, only one argument it's required call _puts lea eax, [esp+1Ch] mov [esp+4], eax mov dword ptr [esp], offset aS ; "%s" call ___isoc99_scanf cmp eax, 1 ;; number of items successfully matched jz short loc_8048539 mov dword ptr [esp], offset aNoPasswordSupp ; "no password supplied" call _puts loc_8048539: ; CODE XREF: main+3E↑j mov dword ptr [esp+4], offset aMetallica ; "metallica" lea eax, [esp+1Ch] mov [esp], eax call _strcmp test eax, eax jnz short loc_804855F ;; INCORRECT PASSWORD PRINT IT mov dword ptr [esp], offset aPasswordIsCorr ; "password is correct" call _puts jmp short loc_804856B ; --------------------------------------------------------------------------- loc_804855F: ; CODE XREF: main+62↑j mov dword ptr [esp], offset aPasswordIsNotC ; "password is not correct" call _puts loc_804856B: ; CODE XREF: main+70↑j mov edx, [esp+9Ch] xor edx, large gs:14h jz short locret_8048580 call ___stack_chk_fail locret_8048580: ; CODE XREF: main+8C↑j leave retn ; } // starts at 80484ED main endp In this code we have first a call to puts printing the text enter password:, we know that is this text thanks to Ida. What follows after that it's a call to scanf, for waiting for the input of the password. Nothing too hard here, so we need to look for the part of the code that validate this password. Right after the call to scanf we have the following code
lea eax, [esp+1Ch] mov [esp+4], eax mov dword ptr [esp], offset aS ; "%s" call ___isoc99_scanf cmp eax, 1 ;; number of items successfully matched jz short loc_8048539 After the call to scanf we check if the user supplied something, in positive case we jump to loc_8048539, that is where our validation it's present. Let's see how this password it's validated.
loc_8048539: ; CODE XREF: main+3E↑j mov dword ptr [esp+4], offset aMetallica ; "metallica" lea eax, [esp+1Ch] mov [esp], eax call _strcmp test eax, eax jnz short loc_804855F ;; INCORRECT PASSWORD PRINT IT mov dword ptr [esp], offset aPasswordIsCorr ; "password is correct" call _puts jmp short loc_804856B Easy! We have a comparison with strcmp to the text metallica, seems Denis is a fan of Metallica, and the printing of the text password is correct.
That's it.
Conclusion
I'm becoming better at this, some progress.
Top comments (0)