I'm trying to learn reverse engineering techniques, apologies in advance if I leave anything out
I'm trying to find the password in the following section of disassembled code (there are other blocks of code in case those need to be included as well)
push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
push esi
push ebx
sub esp, 158h
mov eax, [ebp+arg_4]
mov [esp+1Ch], eax
mov eax, large gs:14h
mov [esp+14Ch], eax
xor eax, eax
mov dword ptr [esp+2Eh], 74726170h
mov word ptr [esp+32h], 32h
mov dword ptr [esp+141h], 32656854h
mov dword ptr [esp+145h], 6150646Eh
mov word ptr [esp+149h], 7472h
mov byte ptr [esp+14Bh], 0
mov dword ptr [esp+4], offset aPassword ; "password:\n"
mov dword ptr [esp], offset _ZSt4cout ; std::cout
call __ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc ; std::operator<<<std::char_traits<char>>(std::basic_ostream<char,std::char_traits<char>> &,char const*)
mov dword ptr [esp+8], 100h ; int
lea eax, [esp+41h]
mov [esp+4], eax ; char *
mov dword ptr [esp], offset _ZSt3cin ; this
call __ZNSi3getEPci ; std::istream::get(char *,int)
lea eax, [esp+40h]
mov [esp], eax
call __ZNSaIcEC1Ev ; std::allocator<char>::allocator(void)
lea eax, [esp+40h]
mov [esp+8], eax
mov dword ptr [esp+4], offset aThisisnotthepa ; "thisisnotthepassword"
lea eax, [esp+38h]
mov [esp], eax
call __ZNSsC1EPKcRKSaIcE ; std::string::string(char const*,std::allocator<char> const&)
lea eax, [esp+40h]
mov [esp], eax
call __ZNSaIcED1Ev ; std::allocator<char>::~allocator()
mov dword ptr [esp+8], 3E8h ; n
lea eax, [esp+41h]
mov [esp+4], eax ; s2
mov dword ptr [esp], offset s1 ; "FBQ2GE9"
call _strncmp
test eax, eax
jnz short loc_8048A74
If the compare succeeds, then the password is correct
I was thinking that it would have been FBQ2GE9
, but that's apparently the wrong answer. What am I missing here?
FBQ2GE9
as the solution? (Mainly because you don't tell why in your post, but particularly interesting because Alex says it is correct after all.)