0

I need to find a password to access the secret:

❯ strings -n 10 win32.exe
!Tip: Ida Free can decompile to c++!
.rdata$voltmd
.rdata$zzzdbg
Bad password length!
Wrong password!
Congratulations! The secret is
There is a secret hiding in this program. To get it, you must enter the correct password....

I've already tried to decompile it to something more readable:

(main function)

int start()
{
  char v1; // bl
  char Buffer[2]; // [esp+8h] [ebp-114h] BYREF
  char v3; // [esp+Ah] [ebp-112h]
  char v4; // [esp+Bh] [ebp-111h]
  unsigned __int8 v5; // [esp+Ch] [ebp-110h]
  unsigned __int8 v6; // [esp+Dh] [ebp-10Fh]
  char v7; // [esp+Eh] [ebp-10Eh]
  unsigned __int8 v8; // [esp+Fh] [ebp-10Dh]
  char v9; // [esp+10h] [ebp-10Ch]
  void *lpBuffer; // [esp+108h] [ebp-14h]
  char v11[2]; // [esp+10Ch] [ebp-10h]
  char v12; // [esp+10Eh] [ebp-Eh]
  char v13; // [esp+10Fh] [ebp-Dh]
  char v14; // [esp+110h] [ebp-Ch]
  char v15; // [esp+111h] [ebp-Bh]
  char v16; // [esp+112h] [ebp-Ah]
  char v17; // [esp+113h] [ebp-9h]
  char v18; // [esp+114h] [ebp-8h]
  char v19; // [esp+115h] [ebp-7h]
  unsigned __int16 i; // [esp+118h] [ebp-4h]

  lpBuffer = aVTomhleProgram;
  WriteStringToConsole(aVTomhleProgram);
  if ( !ReadInput(Buffer) )
    return WrongPasswordLength();
  Sleep(0xFAu);
  if ( (int)GetStringLength(Buffer) > 10 )
    return WrongPasswordLength();
  if ( v9 )
    return WrongPassword();
  v18 = ~v7;
  v15 = ((int)v6 >> (v8 % 5) << (v8 % 5)) + (v5 & 0xF);
  v12 = 4 * v3;
  v17 = 2 * v8 - *((_BYTE *)lpBuffer + 9);
  v13 = v8 + v4;
  Sleep(0xFAu);
  v11[0] = Buffer[0] + 23; // we need to match the v11[0] to byte_402024[0] -> 0x6A - 23 == 0x53 -> 'S'
  v14 = (v6 & 0xF) + ((int)v5 >> (v8 % 5) << (v8 % 5));
  v12 -= 2 * v3;
  v16 = Buffer[0] - v3;
  v1 = Buffer[1];
  v11[1] = ConvertStringToInt(a96) ^ v1; // ConvertStringToInt(a96) results in Ox60 ^ byte_402024[1](0x0EC) -> hex(0x0EC ^ 0x60) == 0x8c ????
  Sleep(0xFAu);
  v19 = v9;
  for ( i = 0; i < 0xAu; ++i )
  {
    if ( v11[i] != byte_402024[i] )
      return WrongPassword();
  }
  Sleep(0xFAu);
  return GetSecret(Buffer);
}

important constants:

.data:00402024 byte_402024     db 6Ah                  ; DATA XREF: start+295↑r
.data:00402025                 db 0ECh
.data:00402026                 db  64h ; d
.data:00402027                 db  96h
.data:00402028                 db 0FDh
.data:00402029                 db  7Bh ; {
.data:0040202A                 db  21h ; !
.data:0040202B                 db    6
.data:0040202C                 db  5Fh ; _
.data:0040202D                 db    0
.data:0040202E                 db    0
.data:0040202F                 db    0


.data:004021F4 a96             db '96',0 

I think that passphrase needs to match the char[12] byte_402024 after all the operations. I've managed to find the first character of the passphrase(I think) which is S. But the second character seems to be weird, It should be 0x8C, but this cant be converted to unicode or ascii. The creator gave me a hint that the passphrase can be made of any bytes, not only text.

0

1 Answer 1

0

The decompiler got the local stack params a little wrong, it seems you have two consecutive buffers of size 10 on the stack. Buffer and lpBuffer respectively. Now you also have a buffer of size 10 in the data segment .data:00402024 byte_402024. You have to carefully follow the calculations to each byte to succeed in the for loop the compares v11[i] != byte_402024[i].

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.