I need to find a password to access the secret:
❯ strings -n 10 win32.exe
!Tip: Ida Free can decompile to c++!
.rdata$voltmd
.rdata$zzzdbg
Bad password length!
Wrong password!
Congratulations! The secret is
There is a secret hiding in this program. To get it, you must enter the correct password....
I've already tried to decompile it to something more readable:
(main function)
int start()
{
char v1; // bl
char Buffer[2]; // [esp+8h] [ebp-114h] BYREF
char v3; // [esp+Ah] [ebp-112h]
char v4; // [esp+Bh] [ebp-111h]
unsigned __int8 v5; // [esp+Ch] [ebp-110h]
unsigned __int8 v6; // [esp+Dh] [ebp-10Fh]
char v7; // [esp+Eh] [ebp-10Eh]
unsigned __int8 v8; // [esp+Fh] [ebp-10Dh]
char v9; // [esp+10h] [ebp-10Ch]
void *lpBuffer; // [esp+108h] [ebp-14h]
char v11[2]; // [esp+10Ch] [ebp-10h]
char v12; // [esp+10Eh] [ebp-Eh]
char v13; // [esp+10Fh] [ebp-Dh]
char v14; // [esp+110h] [ebp-Ch]
char v15; // [esp+111h] [ebp-Bh]
char v16; // [esp+112h] [ebp-Ah]
char v17; // [esp+113h] [ebp-9h]
char v18; // [esp+114h] [ebp-8h]
char v19; // [esp+115h] [ebp-7h]
unsigned __int16 i; // [esp+118h] [ebp-4h]
lpBuffer = aVTomhleProgram;
WriteStringToConsole(aVTomhleProgram);
if ( !ReadInput(Buffer) )
return WrongPasswordLength();
Sleep(0xFAu);
if ( (int)GetStringLength(Buffer) > 10 )
return WrongPasswordLength();
if ( v9 )
return WrongPassword();
v18 = ~v7;
v15 = ((int)v6 >> (v8 % 5) << (v8 % 5)) + (v5 & 0xF);
v12 = 4 * v3;
v17 = 2 * v8 - *((_BYTE *)lpBuffer + 9);
v13 = v8 + v4;
Sleep(0xFAu);
v11[0] = Buffer[0] + 23; // we need to match the v11[0] to byte_402024[0] -> 0x6A - 23 == 0x53 -> 'S'
v14 = (v6 & 0xF) + ((int)v5 >> (v8 % 5) << (v8 % 5));
v12 -= 2 * v3;
v16 = Buffer[0] - v3;
v1 = Buffer[1];
v11[1] = ConvertStringToInt(a96) ^ v1; // ConvertStringToInt(a96) results in Ox60 ^ byte_402024[1](0x0EC) -> hex(0x0EC ^ 0x60) == 0x8c ????
Sleep(0xFAu);
v19 = v9;
for ( i = 0; i < 0xAu; ++i )
{
if ( v11[i] != byte_402024[i] )
return WrongPassword();
}
Sleep(0xFAu);
return GetSecret(Buffer);
}
important constants:
.data:00402024 byte_402024 db 6Ah ; DATA XREF: start+295↑r
.data:00402025 db 0ECh
.data:00402026 db 64h ; d
.data:00402027 db 96h
.data:00402028 db 0FDh
.data:00402029 db 7Bh ; {
.data:0040202A db 21h ; !
.data:0040202B db 6
.data:0040202C db 5Fh ; _
.data:0040202D db 0
.data:0040202E db 0
.data:0040202F db 0
.data:004021F4 a96 db '96',0
I think that passphrase needs to match the char[12] byte_402024 after all the operations. I've managed to find the first character of the passphrase(I think) which is S. But the second character seems to be weird, It should be 0x8C, but this cant be converted to unicode or ascii. The creator gave me a hint that the passphrase can be made of any bytes, not only text.
