Hello and welcome back.
Our next project is from this, uh, this author who wrote this crackme.
So go and download this from my, from my resource section.
So I'm giving credit to the author here.
So download the zip file and unzip it using the password crackinglessons.com.
After you unzip it, inside it you will find these two files. Immediately
make a copy as a backup.
Then scan it with DIE and you will find that it is a 32-bit program.
So let's run it now and see what happens.
It asks you to enter your username, so I don't know what it is.
I just type and type any username.
Then I hit enter.
It asks me to enter the password.
I type 123456.
So I just...
And then I press enter and it immediately closes and I can't see the output whether it's right or wrong.
So I need to run it with a debugger.
I open the debugger and use it to open this program.
And then I need to search for the string
"Enter," "enter,"
"username."
I right-click over here.
And search for current module string references.
And I find all this.
And the one that I want is "Enter your username."
So I go to that location and scroll up to look for the start of the function which contains this string.
And then on the top I will find a function here.
So I can put a breakpoint there and then graph it.
So now I'm ready to run the program and see whether it hits this breakpoint.
It does.
It hits the breakpoint.
I turn on the trace, and then I step over it and keep an eye on the output over here.
Continue to step over it.
And now it comes to this call. After I stepped over this call,
it prints the message,
"Enter your username."
I continue to step over until it comes to the next call.
It is now in a pause state, but when I step over this call, it goes into the running state.
That means it is waiting for me to enter a username.
So I type my username which is just a random name.
Hit enter and now it comes back to a pause state and I can now continue stepping over it.
I continue stepping over it and when I step over this call, it prints out another message.
It prints out another message,
"Now enter your password."
And then I continue stepping until it comes to the next call.
So at this next call it is in a pause state.
But when I step over it, it goes into the running state, which means it is waiting for me to input.
So I just type any, any password, 123456 for example.
And I hit enter.
And now it comes back to the pause state and I'm able to debug.
Now I continue stepping over.
Now it is continuing after this call.
After this call we get some non-zero value and non-negative value.
So just ignore it for now and see what it does.
Continue to step over, continue stepping over.
And now it's going to return.
It's going to return to the main function.
It hasn't shown me any bad messages so far.
So let's step over to return to the parent function.
Step over.
And now I should be in the parent function.
So I can now right-click and follow in this assembler.
And I'm back here.
I'm back here.
I am back here and this is where we just came from.
So I label it "GetInput."
So "GetInput" was what we came from just now.
So this is a function to prompt the user to enter username, read the username, prompt to enter password
and read the password.
That's all this function does.
And then after that we are now in another bigger function.
So we look up and this is the start of this function.
So I will label it "main function."
And then now I can graph this to analyze it.
And so I see that you are now here.
We just came back from this function.
So I continue to step over it.
I can now actually put the breakpoint here to enable the function.
So now let's continue to step over.
So we are now at this new function.
And before we call this function we have this non-zero value.
After we step away we get the zero value.
So this is a function which affects the result of the -.
If we continue to step away,
it continues.
It tries to check whether the - is one.
But because - is not one, jump not equal will jump to 401FB1, which is here.
And that is like it's a bad message.
So we continue to step over this and we see a bad message is showing "Wrong password."
This suggests that this is the function which checks for password.
So I put a comment there.
And now I'm going to enable the breakpoint so that we can come back and analyze what sets the - to zero.
So now I restart the program and I run.
I'm now at the main function.
I continue to run.
Let me put this on the right.
Run.
It asked me to enter the username, so I enter "cracker."
Hit enter.
It asked to enter the password, so I enter 123456 and I hit enter.
And now we are at the, at the, at the function that checks for password.
So I'm going to graph this main function.
So now it has input everything.
So now you can see the main function here.
And we have just called this function to get the inputs.
And now we are here, we are going to call this function, uh, to check the password.
So you need to step into this now.
So let's step into it and then right-click and sync with CPU.
So now we are in the function that checks for the password itself.
We can continue to step over.
We want to see what sets the value of - to zero.
So let's continue.
It's going to the left and now it's going to call this function.
- is not zero.
So continue to step over.
Continue stepping over.
And now over here,
we can see that - is going to come down here, jump is not taken.
So it's going to go to the right.
So when it goes to the right it says zero to -.
That means this is the part that sets the - to zero.
That means this is a bad path.
If you want - to become one, you go to the left and it becomes one.
So in order to go to the left, the value of - and - must be the same.
So - is the first part of the - register, which is now 31.
31 is the ASCII code for the character one, and character one is our first character of our password,
"1."
And then for -.
- is the first byte of the - register, which is 77, and 77 is a hex value.
The ASCII code is "w," so it is comparing whether the password we enter is "w."
So in this case it is "1."
It is not "w."
So because it is not "w" it will move to the right.
So this suggests that the password is just a single character "w" like that, just "w."
So we can test our hypothesis.
We can go and rerun this.
And this time when it comes here we will enter "w."
But for now just continue this and see that it will now move zero to -.
And when it returns to the main function it is going to test whether - is one.
It is not.
So it's going to go to the left and show the message which you see here.
So we're going to restart now and then run.
And this time we're going to enter the correct password.
Let's run again.
Move this to the right.
Run, run again.
Click here and enter your username.
And now enter "w" as the password.
Just one character.
Hit enter and now it comes to our function to check the password.
So let's graph this.
So now is here.
We need to step into this and now we sync it.
Yep.
And we are here.
So let's continue to step over and see what happens when it comes to this line.
So continue to step over.
So you can see now the value in - and - is the same.
- is a "w" and - is also "w."
So that means comparison is true.
So it will jump because it is equal.
So now come over here, click on this.
You will see jump is taken.
It will go to the left.
So it moves one to -.
That is what we want.
So now we continue stepping over and it's going to return to the caller, the main function.
And we are now in the main function.
It compares - to one and - is one.
So it's true.
So because it's true it will not jump to the left.
It is going to jump to the right.
Click on this and you will see jump is not taken.
So it's going to go to the right.
And it's going to print this message by using the print function.
And you can see "Congrats, you are logged in."
So this is how we can fish out the password which is just one single character "w."
So, uh, that's all for this video.
Next video we are going to see how to patch this to, to show the "congrats" message irrespective of whether
or not the password is correct.
So give that a try now before you watch the next video.
See you then.