0

I'm trying to learn reverse engineering techniques, apologies in advance if I leave anything out

I'm trying to find the password in the following section of disassembled code (there are other blocks of code in case those need to be included as well)

push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
push    esi
push    ebx
sub     esp, 158h
mov     eax, [ebp+arg_4]
mov     [esp+1Ch], eax
mov     eax, large gs:14h
mov     [esp+14Ch], eax
xor     eax, eax
mov     dword ptr [esp+2Eh], 74726170h
mov     word ptr [esp+32h], 32h
mov     dword ptr [esp+141h], 32656854h
mov     dword ptr [esp+145h], 6150646Eh
mov     word ptr [esp+149h], 7472h
mov     byte ptr [esp+14Bh], 0
mov     dword ptr [esp+4], offset aPassword ; "password:\n"
mov     dword ptr [esp], offset _ZSt4cout ; std::cout
call    __ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc ; std::operator<<<std::char_traits<char>>(std::basic_ostream<char,std::char_traits<char>> &,char const*)
mov     dword ptr [esp+8], 100h ; int
lea     eax, [esp+41h]
mov     [esp+4], eax    ; char *
mov     dword ptr [esp], offset _ZSt3cin ; this
call    __ZNSi3getEPci  ; std::istream::get(char *,int)
lea     eax, [esp+40h]
mov     [esp], eax
call    __ZNSaIcEC1Ev   ; std::allocator<char>::allocator(void)
lea     eax, [esp+40h]
mov     [esp+8], eax
mov     dword ptr [esp+4], offset aThisisnotthepa ; "thisisnotthepassword"
lea     eax, [esp+38h]
mov     [esp], eax
call    __ZNSsC1EPKcRKSaIcE ; std::string::string(char const*,std::allocator<char> const&)
lea     eax, [esp+40h]
mov     [esp], eax
call    __ZNSaIcED1Ev   ; std::allocator<char>::~allocator()
mov     dword ptr [esp+8], 3E8h ; n
lea     eax, [esp+41h]
mov     [esp+4], eax    ; s2
mov     dword ptr [esp], offset s1 ; "FBQ2GE9"
call    _strncmp
test    eax, eax
jnz     short loc_8048A74

If the compare succeeds, then the password is correct

I was thinking that it would have been FBQ2GE9, but that's apparently the wrong answer. What am I missing here?

  • On what grounds did you reject FBQ2GE9 as the solution? (Mainly because you don't tell why in your post, but particularly interesting because Alex says it is correct after all.) – usr2564301 Jul 27 '16 at 21:32
3

I'm not specialist, especially in C++ re, but password is constructing in the lines:

mov     dword ptr [esp+2Eh], 74726170h
...
mov     byte ptr [esp+14Bh], 0

Second command is null-byte in null terminated strings. Also, you should take care to endianness. So answer is in that numbers: 70617274 32 54686532 6E645061 7274. This is hex representation of password, which you can convert into ascii with python3 command:

$ python3 -c 'import binascii; print(binascii.unhexlify("7061727432546865326E6450617274"))'
b'part2The2ndPart'

So the answer is part2The2ndPart

Also take a look at the Denis's Yrichev reverse engineering book for beginners.

UPDATE

./part1.exe
password:
FBQ2GE9
correct!
username: part2, password: The2ndPart
10.56.15.125
| improve this answer | |
  • How did you construct the hex string? I had 7472617032326568546150646E7472 for it, which is trap22ehTaPdntr in ascii – user906153 Jul 26 '16 at 16:47
  • Also, I tried part2The2ndPart as the password and that did not work either. If you want to look at the binary, I uploaded it here: filehosting.org/file/details/588766/part1.exe – user906153 Jul 26 '16 at 16:48
  • 1
    74726170h = 7061 7274; you should read it from its end via chunks by two – Alex Bender Jul 26 '16 at 17:40
  • @user906153 It's to do with endianness and C standards for storing strings stackoverflow.com/questions/1568057/… – Vitaly Osipov Jul 28 '16 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.