-1

I'm an absolutely beginner in the reverse engineering field. I've an exe program and I should find : address of main function/address of function that validate user input/address of hardcoded password. I have tried with Immuntity debugger and found those addresses : 00E31180(main function),00E31050(fn that validate user input),00E32100(@ of hardcoded password).

But, it seems that I got a wrong response (and i dunno which one of my responses is wrong because they should be all correct to know if i succeeded/no), so could anyone correct me.

I'll be very happy for your help.

Here is the exe file : https://www.sendspace.com/file/6q5xpi Thanks.

1

It's a bit hard to help and correct what you did wrong as you are not showing any indications why you think specific function are what you think they are but let's try (I'll do this purely via static analysis).

The main function was correctly identified. It is the one at offset 0x1180

 115: int main (int argc, char **argv, char **envp);
 │           0x00401180      55             push ebp 

but the rest is wrong.

If we look at the code in the main function especially around the call to your first identified function we can see.

0x00401193      50             push eax
0x00401194      6800214000     push str.Enter_Your_Pass_Key_:__n ; 0x402100 ; "Enter Your Pass Key : \n" ; int32_t arg_8h
0x00401199      e8b2feffff     call fcn.00401050

From the arguments passed to this function (const string "Enter Your Pass Key") we could indicate that the function at offset 0x1050 is more like a printing function than one that validates your input.

Also further code that looks like this

0x004011a4      51             push ecx                    ; int32_t arg_ch
0x004011a5      6818214000     push 0x402118               ; "%s" ; int32_t arg_8h
0x004011aa      e811ffffff     call fcn.004010c0

indicates that here we take the input from the user so it would be hard to validate it before getting it.

Spotting function that does the validation is also simple in this task, as it is just before some comparison and printing good/bad info.

In here the comparison is at 0x11c1 and the function before is 0x0401100 and it takes the user input as an argument. So that's good indicators that it is the validation.

And inside this function we can see that a interesting string is being loaded to a local variable

0x0040110d      c745f4f82040.  mov dword [var_ch], str.elite ; 0x4020f8 ; "elite"

and later it is being compared (byte by byte) with our input. So the valid input is for this program is "elite".

enter image description here

8
  • so the adresses are 0x0041180 for main, 0x0401100 for validation function and 0x040110d for hardcoded password ? (i tried them and got an error)
    – nora
    Apr 13 at 21:25
  • and please what tools do you used for analysis
    – nora
    Apr 13 at 21:26
  • I don't know what you mean by "tried them". Is it a quiz or something? Maybe it expect some specific format of the answers. I used radare2 for analysis Apr 13 at 21:27
  • yeah, it's a quiz : the format is: flag{Answer1|Answer2|Answer3} , i tried above addresses to no avail, do you have any suggestion ?
    – nora
    Apr 13 at 21:39
  • I would strip leading zeros from the addresses but it can be anything. I just hope it's not an ongoing competition. Apr 13 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.