Finding password in disassembled code

Question

I'm trying to learn reverse engineering techniques, apologies in advance if I leave anything out

I'm trying to find the password in the following section of disassembled code (there are other blocks of code in case those need to be included as well)

push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
push    esi
push    ebx
sub     esp, 158h
mov     eax, [ebp+arg_4]
mov     [esp+1Ch], eax
mov     eax, large gs:14h
mov     [esp+14Ch], eax
xor     eax, eax
mov     dword ptr [esp+2Eh], 74726170h
mov     word ptr [esp+32h], 32h
mov     dword ptr [esp+141h], 32656854h
mov     dword ptr [esp+145h], 6150646Eh
mov     word ptr [esp+149h], 7472h
mov     byte ptr [esp+14Bh], 0
mov     dword ptr [esp+4], offset aPassword ; "password:\n"
mov     dword ptr [esp], offset _ZSt4cout ; std::cout
call    __ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc ; std::operator<<<std::char_traits<char>>(std::basic_ostream<char,std::char_traits<char>> &,char const*)
mov     dword ptr [esp+8], 100h ; int
lea     eax, [esp+41h]
mov     [esp+4], eax    ; char *
mov     dword ptr [esp], offset _ZSt3cin ; this
call    __ZNSi3getEPci  ; std::istream::get(char *,int)
lea     eax, [esp+40h]
mov     [esp], eax
call    __ZNSaIcEC1Ev   ; std::allocator<char>::allocator(void)
lea     eax, [esp+40h]
mov     [esp+8], eax
mov     dword ptr [esp+4], offset aThisisnotthepa ; "thisisnotthepassword"
lea     eax, [esp+38h]
mov     [esp], eax
call    __ZNSsC1EPKcRKSaIcE ; std::string::string(char const*,std::allocator<char> const&)
lea     eax, [esp+40h]
mov     [esp], eax
call    __ZNSaIcED1Ev   ; std::allocator<char>::~allocator()
mov     dword ptr [esp+8], 3E8h ; n
lea     eax, [esp+41h]
mov     [esp+4], eax    ; s2
mov     dword ptr [esp], offset s1 ; "FBQ2GE9"
call    _strncmp
test    eax, eax
jnz     short loc_8048A74

If the compare succeeds, then the password is correct

I was thinking that it would have been FBQ2GE9, but that's apparently the wrong answer. What am I missing here?

Answer 1

I'm not specialist, especially in C++ re, but password is constructing in the lines:

mov     dword ptr [esp+2Eh], 74726170h
...
mov     byte ptr [esp+14Bh], 0

Second command is null-byte in null terminated strings. Also, you should take care to endianness. So answer is in that numbers: 70617274 32 54686532 6E645061 7274. This is hex representation of password, which you can convert into ascii with python3 command:

$ python3 -c 'import binascii; print(binascii.unhexlify("7061727432546865326E6450617274"))'
b'part2The2ndPart'

So the answer is part2The2ndPart

Also take a look at the Denis's Yrichev reverse engineering book for beginners.

UPDATE

./part1.exe
password:
FBQ2GE9
correct!
username: part2, password: The2ndPart
10.56.15.125