Reverse Engineering

Tryhackme - Reverse Engineering

 crackme1 

hint :- did you check the strings stored in the executable?

 

./crackme1.bin

chmod 777 crackme1.bin

Now I have the answer.

 

 strings crackme1.bin 

 

Let’s debug,

r2 -d ./crackme1.bin

and ..Analyze command - aaa then afl is list of functions  and There’s a main function.

There’s password declaration and strcmp function.

  

pdf @main

 

Let’s look into variable’s value.

Set breakpoint at strcmp

 

db 0x56163a9737c7 

dc

pdf @main

 

Now I have breakpoint.

px @ rsi

There’s a password.

#1 :- what is the correct password?

Answer :- hax0r

 

---

crackme2 

Run the program

./crackme2.bin

strings ./crackme2.bin

 Let’s debug,

r2 -d ./crackme2.bin

There’s a main function.

There’s comparison with value.

 
Convert from hexa to decimal

 

#2 :- What is the correct password?

Answer :- 4988

crackme3 

Run the program

./crackme3.bin

 Let’s debug

dc 

pdf @main

Run another step.....

ds 

 

pdf @main

Let’s check the value

Variable “var28_h” is “rbp-0x28”.

 

px @ rbp-0x28

I just try to answer this and it’s correct.

 

#3 :- What are the first 3 letters of the correct password?

Answer :-azt