0

Background: I'm a beginner reverse engineer and I wanted to try writing my own c++ programs and reverse-engineering them. I wrote something and I'm not sure a smart way of reversing it. Usually, I can think of it as a math formula and just do it in reverse to figure out the algorithm but I can't think of any other way than brute-forcing for this scenario.

#include <iostream>

using namespace std;

int main()
{
    char key[9];
    int total = 0;

    cout << "Enter Key: ";

    cin >> key;

    for (char item : key)
    {
        total = total + (int)item;
    }

    if (total == 895)
    {
        puts("Correct");
    }
    else
    {
        puts("Sorry buddy");
    }

    return 0;
}

btw sorry if my c++ isn't very good. I am new to this language haha

Main Goal: I want to know if there is a smarter way of going about this or is brute force the only way. Thanks!

1

Your code basically takes 9 chars, 8 from user input + 1 null terminator. each one can be between 0-255.

You char array bytes are signed, so maximum value for each is 127 (hex: 7F)

You want the result of those byte values to end up equal to 895.

In order to achieve the result, you need to pass any combination of bytes that sum up to your value.

Example: 127*7+6 = 895

hex: \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x06

This will solve your algorithm:

echo 7f7f7f7f7f7f7f06 | xxd -r -p|./compiled_executable

xxd -r -p simply takes hex values and converts them to chars.

Note that the max value your input can end up with is 1016. More than that - nothing will solve it and it will always fail.

| improve this answer | |
1

The question is not clear. Are you asking about

  1. an approach to finding a single input that results in "Correct" being printed? or
  2. an approach to deriving a method that will generate correct inputs for you (e.g. keygenning)?

If it is 1, then the answer is as simple as using a calculator.

If it is 2, then many options exist, such as using a constraint solver (z3, angr, KLEE).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.