IOLI_0x04
Run pdf @ main and we see a sym.check function at 0x08048559;
pdf @ sym.check:
At this address, we see something is compared to the integer 15 (0xf).
0x080484d6 837df80f cmp dword [var_8h], 0xf
Tracing back, we see strlen function is called to get the string length(i.e. number of characters) of the input
| : 0x0804849b 890424 mov dword [esp], eax
| : 0x0804849e e8e1feffff call sym.imp.strlen ; size_t strlen(const char *s)
Sscanf is called to get a character from our password.
| |: 0x080484c6 890424 mov dword [esp], eax
| |: 0x080484c9 e8d6feffff call sym.imp.sscanf
With the loop for len times, which len is the length of our password, these number add together, and compare with 0xf(aka 15). So let’s try password with all digits adding up to 15.
0x0804849e e8e1feffff call 0x108048384 ; (sym.imp.strlen)
| | 0x080484a3 3945f4 cmp [ebp-0xc], eax ;;compare the length of input with counter
| | ,== length, jump to the addr
| | | 0x080484a8 8b45f4 mov eax, [ebp-0xc] ;;get value from counter which is index
| | | 0x080484ab 034508 add eax, [ebp+0x8] ;;get eax = &(input[index])
| | | 0x080484ae 0fb600 movzx eax, byte [eax] ;;get eax = input[index]
| | | ;-- eip:
| | | 0x080484b1 8845f3 mov [ebp-0xd], al ;; [ebp=0xd] = input[index]
| | | 0x080484b4 8d45fc lea eax, [ebp-0x4] ;;get addr of [ebp-0x4]
| | | 0x080484b7 89442408 mov [esp+0x8], eax ;;pass this addr as param which is ret value
| | | 0x080484bb c7442404388. mov dword [esp+0x4], str.d ;;pass "%d" as parm for sscanf()
| | | 0x080484c3 8d45f3 lea eax, [ebp-0xd] ;;get addr of input[index]
| | | 0x080484c6 b 890424 mov [esp], eax ;;pass it as param to sscanf()
| | | ; CODE (CALL) XREF from 0x080483a4 (fcn.0804839a)
| | | 0x080484c9 e8d6feffff call 0x1080483a4 ; (sym.imp.sscanf)
| | | sym.imp.sscanf()
| | | 0x080484ce 8b55fc mov edx, [ebp-0x4] ;;move ret value from sscanf to edx
| | | 0x080484d1 8d45f8 lea eax, [ebp-0x8] ;;get addr of total sum
| | | 0x080484d4 0110 add [eax], edx ;;add ret value to total sum
| | | 0x080484d6 837df80f cmp dword [ebp-0x8], 0xf ;;compare total sum with 0x0f
| |,== 0x080484f4 8d45f4 lea eax, [ebp-0xc] ;;get counter address
| | | 0x080484f7 ff00 inc dword [eax] ;;increase counter by 1
./crackme0x04 IOLI Crackme Level 0x04 Password: 69 Password OK :)
















