IOLI 0x05

    the check() function:

    1. /* r2dec pseudo code output */
    2. /* ./crackme0x05 @ 0x80484c8 */
    3. #include <stdint.h>
    5. int32_t check (char * s) {
    6.     char * var_dh;
    7.     uint32_t var_ch;
    8.     uint32_t var_8h;
    9.     int32_t var_4h;
    10.     char * format;
    11.     int32_t var_sp_8h;
    12.     var_8h = 0;
    13.     var_ch = 0;
    14.     do {
    15.         eax = s;
    16.         eax = strlen (eax);
    17.         if (var_ch >= eax) {
    18.             goto label_0;
    19.         }
    20.         eax = var_ch;
    21.         eax += s;
    22.         eax = *(eax);
    23.         var_dh = al;
    24.         eax = &var_dh;
    25.         sscanf (eax, eax, 0x8048668);            // 0x8048668 is %d
    26.         edx = var_4h;
    27.         eax = &var_8h;
    28.         *(eax) += edx;
    29.         if (var_8h == 0x10) {
    30.             eax = s;
    31.             parell (eax);
    32.         }
    33.         eax = &var_ch;
    34.         *(eax)++;
    35.     } while (1);
    36. label_0:
    37.     printf ("Password Incorrect!\n");
    38.     return eax;
    39. }

    The same, we can write our own C-like pseudo code.

    1. [0x08048484]> s sym.parell
    2. [0x08048484]> pdd@sym.parell
    3. /* r2dec pseudo code output */
    4. /* ./crackme0x05 @ 0x8048484 */
    5. #include <stdint.h>
    7. uint32_t parell (char * s) {
    8.     char * format;
    9.     int32_t var_8h;
    10.     eax = &var_4h;
    11.     eax = s;
    12.     sscanf (eax, eax, 0x8048668);
    13.     eax = var_4h;
    14.     eax &= 1;
    15.     if (eax == 0) {
    16.         printf ("Password OK!\n");
    17.         exit (0);
    18.     }
    19.     return eax;
    20. }

    the decompiled code looks well except the sscanf() function. It can be easily corrected by checking the assembly code.

    The mov dword [esp], eax is the nearest instruction to sscanf (and it’s equivalent to a push instruction). It stores the string ‘s’ to the stack top (arg1). mov dword [var_sp_4h], 0x8048668 push ‘%d’ as arg2 into stack. var_8h (esp + 0x8) which keeps the address of var_4h is the arg3.

    1. uint32_t parell (char * s) {
    2.     sscanf (s, %d, &var_4h);
    3.     if ((var_4h & 1) == 0) {
    4.         printf ("Password OK!\n");
    5.         exit(0);
    6.     }
    8. }

    Now there are 2 constraints:

    • Digit Sum is 16 (0x10)
    • Must be an odd number (1 & number == 0)

    The password is at our fingertips now.