Hello and welcome back.
In this video, we are going to try another project,
this crackme by Dajoh.
I already provided this for you, so use the version that I downloaded rather than download from here.
So after unzipping it, you should have a crackme_1 here.
And this is the credits given to the developer.
So let's run it and see what happens.
It asks to enter password, so we don't know what it is.
So we type 123456789,
hit Enter, and it says fail.
You entered the wrong password.
Next thing to do is to check whether this is a 32-bit or 64-bit program.
So we should scan this with DIE.
So open up your DIE wherever you installed it.
And click this to open the crackme.
And you will see that it is a 32-bit program.
It is written in Visual C++.
So we should use x32dbg.
So,
now take note of the string
here:
Fail.
You entered the wrong password.
So we are going to search for the string.
So let us open this now.
Let's close this now.
And open
this crackme_1.
Now let's search for the string "fail."
So we right-click here, Search for, Current module, String references,
and look for the string fail, fail.
It has found it.
So let's go to that address and scroll up.
That's our string.
And we scroll up to look for the start of this function.
So scroll up and you look for -.
So put the breakpoint there.
And now we can
restart this program and run to that breakpoint.
Restart the program.
I'm going to resize my window so I can see the program running at the back.
So this is the program running there.
So we run to our first breakpoint, and here we will turn on the tracing.
Trace coverage, select all.
Now it turns green.
So whenever you trace, it will highlight all the paths that you have taken in green background.
Now we are going to graph this.
So you right-click, go to graph.
And you can see clearer now.
Now we step over line by line.
And now it draws this line using this call.
Now it draws this second line with this call.
And it draws this text here from this call.
And just this line now from this call.
Now it brings the prompt "Enter password" from this call.
And now if I keep clicking this, it doesn't move anymore.
That means it's waiting for me to enter the password.
Since I don't know the password, I will click here and type 1234567890,
hit Enter.
So now we can resume our tracing.
So now it's going to move this string into -.
- is the register here.
So if I step over this,
- now has got the string
easy
password.
Next, it's going to move the first character of - which is one, into the register
-.
- is the first byte of the - register.
So let's step over this and see that happening.
So now it has moved the first byte of - into -.
The first byte is one.
How do I know it's first byte? Because of the byte here.
When you see byte here, it means that you are taking the first element of this string, which is one
byte, and moving it to -.
If you see a word here, it means it's taking two bytes, one and two, moving into here, and so on.
So now to check what is in -,
if you look here, you won't see it because - is the first byte.
In order to see what's in the first byte, we can go down to the command terminal here and type
-.
Hit Enter, and you will see - holds the hex 31.
Now hex 31,
what is hex 31?
Hex 31,
let's take a look.
If you go and look at the ASCII table for hex 31,
it is one.
So it has moved the character one, character one into -.
That's why you see 31, 31 is one.
Next, it's going to compare one with the first byte of, the first byte of - is E.
That means it is comparing E with one.
So this suggests that it is expecting you to enter E as a first character for the password.
Let's see what happens.
So what will happen?
Let's step over,
step over.
Step over now, and you will see the comparison fails because - is not equal to the first byte of -.
So because it is not equal, JNE will jump. JNE,
if you click on this, it says jump is taken.
That means it's going to jump down here.
So now we can make a note here, a comment here.
- has got the value of one.
Then after we put the comment, we need to refresh the screen.
Then we can see the new comment.
And then it's going to compare one with -,
so the first byte of - is E.
So since one is not equal to E, jump not equal is true.
So it's going to jump over to this address 561166, which is here.
So it's going to jump there now.
And what is it going to do? - to -.
It's going to SBB.
So SBB is, it will convert this to negative one.
Negative one in hex is all F's.
Let's take a look.
See that it becomes all F's.
So whenever you see all F's in the - register, it's bad news. It means something has gone wrong.
Now next one is, it's going to OR - with one.
So when you OR anything with one, it still retains the same value.
No difference.
Take a look.
Step over now, it's still all F's.
So next, it will go here and you will test whether the - is zero.
Now - is not zero, it is negative one.
Therefore, jump equals will fail.
So let's see what happens.
Now we click on this.
You will see jump is not taken.
Why?
Because - is not zero.
- is negative one.
So it will not jump to 56110.
It won't jump here.
It will not jump to 56110, is a good message.
You see that it will not jump there.
Instead, it will go straight.
So let's see that happening.
So it goes straight, and it's going to show you the bad message: failed.
You entered the wrong password.
See that?
All right, so if you run all the way, you will see this message here.
All right.
So this gives us a hint that the first character of the password should be E.
Correct.
From this analysis, we can summarize, we can conclude.
So we are going to rerun this.
This time we are going to enter E as the first character of the password and see what happens.
So let's run to our breakpoint and then graph it.
Next, we arrange our windows.
Let's step over.
All right.
So it's reached here.
So we can comment this part. We remembered previously, when we analyzed it, it was waiting for input.
Let's put a comment so that it's easier to read.
Refresh to see the comment.
All right, so now we step over this.
It will not move because it's waiting for input.
So we click over here.
And how do we know it's waiting for input?
Because you see it's running down here.
It is not paused. When you're stepping over,
it should be paused.
So let's come here and type the first character as E,
and then the rest of it.
We deliberately enter the wrong password.
So we put two, three, four, five, six, seven, eight, and so on.
Hit Enter.
So now it's come back to our control, as you can see,
paused, so we can continue.
Continue stepping over.
So step over now. It's going to move
easy password into - again. Watch -.
Right now it's going to move the first character of -, which is E, into -.
So let's see that happening.
Step over.
And now we check what is in -.
Hit Enter, and - now has got the hex value 65.
And let's compare 65.
What is 65 in hex? 65 will give us
E. So 65 is a hex for E, so - now has got the character E after this line.
So we update our comment.
We put a comma at the back.
Previously it was one, now it is E.
Refresh.
All right.
So this is called comment tracing.
This technique is called comment tracing.
We update the comment each time we iterate through so that we can analyze and understand the algorithm
or how the program works.
So now we know the character in - is E.
Next, it's going to compare E with the first character in -.
So the first character in - is also E.
So you can see from here as well.
So this comparison will succeed.
Let's step over.
And because the comparison succeeds, jump not equal will not jump.
See that.
Click on
this: jump is not taken.
So it's supposed to go straight,
and let's do that.
So you go straight.
Is - zero or not?
- is not zero because - is 65.
So since - is not zero, it will not jump to 56112.
Instead, it will continue to go straight.
Now it's going to move the second character of your password to the - register.
How do I know that?
Because - plus one. - plus one is an offset to the second character.
The first character is -, second character is - plus one, third character is - plus two, fourth character
is - plus three, and so on.
It's just like arrays, even in programming.
Array offsets are, you can denote them by putting zero, one, plus one, plus two, plus three, and so on.
So the first character of the string is always - plus zero.
Second character is - plus one.
So - plus one refers to two, two.
So it's going to move two into -.
So let's step over and see that happening.
So let's check now, -.
Okay.
Yeah,
- now has got the hex value 32.
So what is 32?
So when you look for hex value 32, hex value 32 is two.
So it has moved two into the - register.
And now it's going to compare two.
It's going to compare two with what is in the second character of easy password.
So the second character is A, A over here.
How do I know?
Because it says plus one is offset to the second character.
Just like here,
- plus one is offset to the second character.
Same also here.
- plus one. If - is - plus zero, then it's referring to E.
If it's - without any plus at the back, it means - plus zero.
So it will refer to E.
But now it's - plus one,
so it's referring to A.
So now it's comparing whether or not the second character of your password that you entered is the same
with the A.
But in this case, it is not the same.
So this comparison fails.
So this will be true.
It will jump.
So we go to this, jump
not equal is taken, right?
So when it's taken, it goes back here.
And this will be bad news because we remember from the last time we first ran,
whenever it comes here, SBB will cause - to become negative one, so it will fail.
Take a look.
- becomes negative one.
So this,
this suggests that the password, the second character of the password is A.
The first character is E.
Second character should be A.
All right.
And from there alone, we can already more or less have a good guess that the entire password should
be easy password.
All right.
So from there we can try it.
Now let's run the program.
Run the program, run, and then now when this thing comes up,
you enter
easy password.
Easy password.
Hit Enter.
Congratulations!
So we have successfully fished out the password using comment tracing.
Okay, now there are other easy ways to solve this using hex editor.
And if you use hex editor, you can search for all the strings in the file,
and you might find this string there.
But if you use the x64dbg way to solve it, it is more difficult,
but it will give you good skills which you can use later on when you are dealing with more complex,
complex, complicated crackmes where the strings are not easily visible in a hex editor.
So that's why I go through the troublesome way of tracing it, so that you can gain the skill to do
the more complicated crackmes later on.
So that's all for this video.
Thank you for watching.