enter image description here

this is I got so far

#include <windows.h>

int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){

    int k =0; 
    int j= 0 ;  

    int i;
    for (i=0; *(lpCmd+i)  ; i++) {
    while (i < j) {
        j = *(lpCmd + i);//j = ECX *lpCmd = EDX
        *(lpCmd) = i + *(lpCmd);
    return 0;

I'm stuck with


anyone give me some hint to solve this question? is this represent the pointer?

  • 2
    At least include addresses in your disassembly output, insert matching comments into the C code, and post all of the function if you want to give us any chance to read your code. – Guntram Blohm Nov 18 '16 at 11:30

Although the complete picture of your assembly cannot be reconstructed, as there is something missing at the bottom, it can be said that your C re-coding is correct in the first (and simpler) loop, but wrong in the second loop.

First loop: This is simply a strlen of the command line parameter, being stored in the local variable i.

Second loop: Calculation of k from each character of the command line (presumably, because the rest of the loop is missing), taking into account the old k value. Probably that algo is part of your crackme.

Also, your "while" comparison of the 2nd loop is wrong.

The re-compiled code as I see it could look like follows (probably correct until the last statement of the second loop, the rest remained your secret):

 int WinMain(_In_ HINSTANCE hInstance, 
    HINSTANCE hPrevInstance,
    LPTSTR    lpCmd,            //ebp+10h
    int       nCmdShow)
    int j = 0;      //ebp-4
    int i = 0;      //ebp-8
    MessageBox(0, "crackname", "", 0);
    int k = 0;      //ebp-c

    //you got this correct
    //i contains the string length at lpCmd, i.e. the command line parameter length
    for (i = 0; *(lpCmd + i); i++) {

    //iterate through all elements of the parameter and calculate sth.
    //the algo calculates k and probably j is incremented. 
    //However, the rest of the loop is missing in your assembler code
    while (j < i) {
        k = *(lpCmd + j)+k-0x2f; //this contains the lea statement
        //from here, your code is missing
    //MessageBox(0, "success", "", 0);
    //return 0;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.