Length requirement on IOLI crackme input

Question

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all of the dissassembly here if it would help.

I'm working on number 5 and I'm confused on one aspect. I understand how to get the solution and get the password ok, but there seems to be a length on the input that I can't trace back to any of the assembly.

The numbers can add up to more than the 10h and the last one can be odd, but once the input is passed 9 characters, it's not accepted.

I'm using gdb and ida and whatever other tools seem helpful, but the specific tools don't matter much to me. Post an explanation with a radare output if you want.

Answer 1

The reason for your observation is an overflow in the sscanf call that is done in the function checking if the number is even or odd. While the check for your 9-character password succeeds the 10-character password produces an overflow and the check fails.

To verify, compile and run the following C code:

#include <stdio.h>
#include <stdlib.h>


int main ( ) 
{
    int number;

    sscanf ( "222222222", "%d", &number );
    printf ( "Number (9 digits): %d\n", number ); 

    sscanf ( "2222222222", "%d", &number );
    printf ( "Number (10 digits): %d\n", number );

    if ( number & 0x01 == 0 ) {
        printf ( "Even!\n" );
    }
    else {
        printf ( "Odd!\n" );
    }
    return 0;
}