Crackme: atherusti's First C program

Download here:https://crackmes.one/crackme/68c96889224c0ec5dcedc063
MD5: fdb187c953ae9e0e98e18b1fc0683ef1
SHA1: e1f4f4a1e0629ba38cfa567c45cbee6092aabf0a
SHA256: 03832f7e8e8fdfd6ee87ef4efb3eab52252edbfe246c9d2bfdd39166a27c9e30

This is listed as a C/C++ x64 executable with a difficulty rating of 2.0. The author is atherusti and the executable is written for Windows.

The authors description:

never coded before making this crackme, get the password

That's a really interesting first programming project but I'm all for it. Let's tear this bad boy apart and see how they did.

The first thing that immediately jumps out to me is seeing that it is actually an x86 executable. No big deal but its something to keep in mind. Our calling conventions are going to change. I also don't expect to see a shadow stack. One final note, this is a console application.

Taking a look at the string entries doesn't really reveal anything. I find that a little strange. They must be encoded/encrypted somehow. At this point, I decided to take a look at the entropy and see if the executable is possibly packed. Detect it Easy doesn't believe the executable to be packed but the .text section does have a pretty high entropy score especially when compared to all of the other sections. Strings are normally stored in the .rdata section and that has a relatively low score. My guess is that the strings are going to be getting stored as integers in the .text section.

Using PE bear to take a look at the function imports, we can see that there isn't really a whole lot going on. It is only importing 3 libraries. But we should definitely expect to see strings in an executable like this.

After popping the executable in Ghidra and running all the defaults, the entry point seemed kind of strange. I normally expect to see some CRT stuff and when taking a look at the disassembly, I normally see three pushes before a function call about 2/3 of the way through the function. That is normally the programs real main function. I poked around for a bit and kept stumbling through compiler generated code before deciding to take a different approach. I noticed that one of the imports was scanf, my assumption was that this was going to be used to get user input so I searched for where it was cross referenced and ended up here. This is what I believe to be the programs true main function. It also confirms that the program is storing the strings as integers in an integer array. Good guess work earlier.

So, what I've determined is happening is this. A global integer array is copied to a local array. Next, some arithmetic is performed to extract the appropriate ascii characters. On the first for loop, the index begins at 0. So it grabs the first element and then it is divided by 1 which essentially results in just grabbing the first element. The first element happens to be 0x49 which is equivalent to the letter I. At this point, I need to perform a sanity check and see if the the first character printed to the console is actually an "I". If this is the case, the algorithm is fairly simple.

local_integer_array[i] / [i + 1]

Let's execute the program and see what we get.

"Input the password: "Alright. So we got it. Now all we need to do is write a program to rip the correct password out.

It looks like our password is banana. Let's just go ahead and verify.