| Analysis:
Examining the main function: The program first asks the user for a number (N), which determines the number of password entry attempts. It then enters a loop that executes N times.
Password Check Logic: Inside the loop, the program:
Prompts for password input.
Reads the entered string.
Calculates the sum of the ASCII codes of all characters in the entered string. In the assembly code, this is implemented by the loop at address 0x00401140, where the edi register accumulates the sum.
Determining the Target Value: The sum of ASCII codes (edi) is compared with the constant 0x6E2 (1762 in decimal), as seen in the cmp edi, 6E2h instruction (0x00401150) and the if ( v6 == 1762 ) condition in the pseudocode. This is the target value for the sum of the password's ASCII codes.
Determining the Password Length: If the sum of ASCII codes matches 1762, the program displays a hint message: "[+] so close !! here is a hint: \n you need it to be %d char\n". Before calling the print function (sub_401020), the value 11h is pushed onto the stack (push 11h at address 0x00401158), which corresponds to 17 in decimal. This value is used to format the %d string, indicating that the required password length is 17 characters.
Calculating the Password:
The task boils down to finding a 17-character string whose sum of ASCII codes equals 1762.
The average ASCII value per character is
1762
/
17
≈
103.65
1762/17≈103.65.
The closest ASCII codes are 'g' (103) and 'h' (104).
We set up a system of equations, where
n
g
n
g
is the number of 'g' characters and
n
h
n
h
is the number of 'h' characters:
n
g
+
n
h
=
17
n
g
+n
h
=17 (length condition)
103
⋅
n
g
+
104
⋅
n
h
=
1762
103⋅n
g
+104⋅n
h
=1762 (sum condition)
Solving the system yields:
n
h
=
11
n
h
=11 and
n
g
=
6
n
g
=6.
Result (Key): The password must consist of 17 characters: 6 'g' characters and 11 'h' characters. The order of the characters does not matter for passing the check. An example of a valid password is: gggggghhhhhhhhhhh.
Verification: Entering the password gggggghhhhhhhhhhh into the program results in the output messages "[+] so close !! ..." and "[+] although i know you can see it from a dissambler\n", confirming the correctness of the found key and the analysis. |
==> |