Hello and welcome back to a new project.
In this project, we are going to learn how to do deep tracing for username and password.
So we are going to trace many levels deep into the functions in order to trace the username and password.
So this—I am giving credit to the author for this crackme that we are going to try next: Creeps.
So use the version that I already provided for you from the resource section.
Unzip it and then put it in your crackme folder on your desktop.
Let's run it and see what it does.
Before that, make a copy of it so that in case you make a mistake, you still have a backup copy.
So let's run it.
Now it asks for the username.
So we just type in any username.
Hit Enter, and it says "User not registered."
It didn't even ask for the password.
It just says "User not registered."
So the next thing you do is to check with Detect It Easy and to confirm that it is a 32-bit program.
So go ahead and do that.
I've already done it and confirmed that it's a 32-bit program.
So I'm going to use -32 debug to open this.
And we are going to search for this string "registered" in this program.
OK, so now search for the string "registered."
Search for > Current Module > String References, and look for "registered."
Registered.
And there you have it.
"User not registered."
Same as this.
So go ahead and click on this to go to that address where the string is found.
And if you scroll up now, you will see this is the bad string.
And on top, you have a good string.
And then now we're going to scroll up and look for the start of this function, which is the push -.
Then give a comment there to label it as "main."
So I've done that already.
So you just graph it now and try to see the
logic.
So we trace it.
Now we put the
trace—coverage password.
OK, now it hits our breakpoint.
So it has hit our breakpoint.
We will step over.
And watch the output here.
Step over this.
And immediately after this call, username prompt is showing.
So just put a label here to remind yourself that this is the line where the username shows.
So now, keep on running.
Keep on stepping over until you see this thing in the running state
on the bottom left.
OK, now it's in the running state.
It means that it is waiting for you to enter a username.
So let's enter a username.
"Cracker."
And once you hit Enter, it goes back to a paused state, and it waits for you to debug.
So let's step over.
OK.
So now over here, let's graph this and follow the graph view.
We are now here, and it's going to come over here.
So let's step over.
And then step over again, and notice that after this step over, the value in - becomes zero.
It then moves the value zero to -, and then now it's going to test whether - is zero.
If - is zero, - is zero is true.
It's going to jump to D995D9.
So it's going to jump to the left.
And it's going to show you this bad message:
"User not registered."
If you look up on the right, you will see it coming up.
Here you are. After this call,
this bad message shows up.
"User not registered."
So put a comment here to remind yourself.
This is the line where it says "User not registered."
So it means that this is the call which checks the username.
Because after this call, the - becomes zero, and because - is zero, - is zero, and because - is
zero, it jumps to the left.
That means if you want to know what is the username, we have to step into this to investigate.
Why does this make -
why does it make - zero?
So we put a breakpoint here.
Now we are going to run to this breakpoint now.
So let's close everything and restart. Run, run.
Now we enter any username.
And then it hits our call here: "Check username."
So we have to step into this to see why is it setting - to zero.
So we step into it.
So I'm going to jump there.
So step over and jump there.
So this is the function which checks for username.
And also later on, I found out it also checks for password.
But the first time it runs, it is checking for username.
So now let's go and trace this.
Let's first graph it and see the control flow.
So it's very linear—straight line.
So we don't need to graph it.
Go back to Disassembly view and step over.
Introduce.
OK.
So we have to determine which of the calls causes - to become zero.
So step over, and you will find
you will know that it is after this call.
It has become zero because I have done it before.
I know. I put a comment there, so you can do the same.
Step over and see if it became zero.
That means this is the call which sets the - to become zero.
So we have to go into this now and trace why - is becoming zero.
All right.
So let's restart. Run.
Now enter the
enter the username "cracker."
Step into this.
And then now it's checking for your username.
So we're going to go to this line.
So run to that line and step into it to see why - becomes zero.
So step into it.
Step over. OK.
So now we're not sure whether this is string compare, but just temporarily
give it a name "string compare function."
And then here also we have to trace which line says - becomes zero.
So let's graph it first to see the control flow logic. It's also linear.
So there's no advantage in graphing it because it's linear.
So let's go back to Disassembly view.
So let's step over and see which line causes - to become zero.
Just step over.
And you will find it is this line where - becomes zero.
So let's see it happening.
Step over, and straight away you see - becomes zero.
OK.
So this is the line which causes - to become zero.
So now our next target is to go into this.
So we set our breakpoint here. At this function, we are going to investigate this next.
So restart. You notice we are stepping into three levels deep.
So this is part of tracing—deep tracing.
And then enter the username.
Hit Enter.
And then check the username.
Step into this. Jump.
Run to this line.
Step into it.
Step over, and then go to this line.
So you run to that line and step into it and see why - becomes zero.
Step into it.
Step over.
All right.
And now we can graph it.
We can graph it.
And we see the logic—which module, which box sets the - to become zero.
And we can see probably this one.
Right?
Because over here it says it moves zero to this stack, and then it moves the stack to -.
That means, what if this is zero?
This will be zero as well.
- will be zero.
So this is the one that sets - to zero.
So let's compare and see.
Let's step over and see that happening.
OK, this is my comment from my previous analysis.
Just ignore it for now.
So now you will see when it came over here, jump not equal is taken.
That means it's going to jump here.
It's going to jump here. OK.
And it's going to jump.
And you can see it sets zero to this stack.
And then when you step over, it moves zero into -.
So take a look at - now.
It becomes zero.
All right, so now we know this.
This jump moves to the left.
If we don't want it to go to the left, we have to examine
why does it go to the left?
It goes to the left because of this comparison: jump not equal.
That means - is not equal to - plus 14.
That's why it goes to the left.
So we have to know what is the - and what is - plus 14.
All right.
So let's now put a breakpoint here.
We are going to jump.
We are going to come here now and analyze what is inside
- plus 14.
So let's restart.
Remember the name of the function: "String
compare inner function." OK.
Enter
username.
"Cracker."
Right here.
Step into.
Step over, and then run to this line.
Step into it.
Step over, and then run to this line.
Step into this.
So we are going deeper and deeper.
Step over.
Now we are at the correct function.
So we want to analyze what is inside - plus 14.
So let's step back line by line until we reach that line.
OK.
So at this point now—remember, let me graph this so you can remember what we are trying to do.
Click on this and graph.
All right, so we know we are here.
We are trying to find out why is it going to the left?
It's going to the left because - is not the same as - plus 14.
So we want to know what is inside - plus 14.
OK, so you look at -. It's called seven.
Now seven is probably the
length of our username. "Cracker" has got seven characters.
So - stores the length of our username.
Let's suggest that - plus 14 is the length of the actual username.
So to find out what is the length of the actual username, we can come down here and type the command: same
as this - plus 14—in square brackets—in square bracket [- plus 14].
And then we hit Enter.
We can see that - plus 14 is four.
This suggests that the value stored at this stack is four.
So it's comparing four with seven.
Our username is seven characters.
This suggests that the actual username is only four characters.
All right.
So if we put a four-character as our username, then probably it won't jump to the left.
It will go straight.
So let's test our hypothesis.
So now we're going to restart.
And then we're going to run.
And we're going to enter a four-character username. Four-character name is CRAK. CRAK—four characters. Hit Enter.
OK, so now we are here.
Let's run again.
OK.
Step into this.
Step over.
Run to here.
Step into this.
Step over.
OK, so now we are going to come here and see what happens.
We are going to come here—just like in the comparison line.
OK, now you see our - is four.
That means we were right in assuming that this - is the length of our username.
So this is four.
And what is - plus 14?
Press the up arrow key to retrieve the previous command.
Hit Enter, and - plus 14 is four. So - is four, - plus 14 is four.
So they are equal.
So it's not going to jump.
Let's take a look.
Click on this. Jump not taken.
Correct.
So now we click on this and graph it.
Right-click, graph it.
OK, so now we are here at string compare inner function.
Let's step over
until we come to this line.
So - is four now—same as our username.
Four characters long. - plus 14, as we have seen previously, is also four.
So because they are the same, it is not supposed to jump here.
Let's see.
It's supposed to go straight.
OK.
It's going straight.
All right.
Now over here, it's going to test again over here
whether to go left or right.
So we click on this. It says "Jump is taken."
That means it's going to go left also.
That means probably this function here is testing for the actual username.
This part here is comparing the length.
And this part here is comparing—checking for the actual username. OK.
So in this case, test -. Is - zero?
No, it's one.
So that's why it's going to the left.
So it is this call that sets it to one.
So we have to examine this next.
So we put a breakpoint here now and come back to this.
So here is now where it's going.
Let's put a comment there.
"Check actual
actual
username."
OK, refresh to see the comment.
Refresh.
All right, so we're coming back here afterwards.
So let's restart and run.
Run.
Enter our username: CRAK.
Hit Enter.
And then now we are going to read the input.
So we run again.
Step into this.
Step over, and then run to this line.
Step into this.
Step over, and then we're going to run to this line.
OK.
Run again.
So now we have to step into this to see how it compares the username.
We know it's four characters.
Now we want to know the actual username.
So we step into it.
Step over.
All right.
So now here is checking the actual username, so we can graph it.
It's linear.
So there's no advantage in graphing.
So we go back to Disassembly view.
OK.
So let's step over now and see how or where it is comparing.
OK, after this call, you realize that - became one.
OK.
It became one.
And then
so now it continues stepping over.
All right.
So now it's going to return one in -.
It's going to return one in -.
And then if we graph this.
It's going to return one in -.
So you can see what happens here.
So because - is not zero—
- is one—it's going to go to the left.
So that means that the previous call, if the username is not the same—not the correct username—then the
result will be - one.
OK.
So we have to go back and re-examine the previous function.
So now it's going to the left, and it's going to set zero to this.
And it's going to move zero to -.
And that is bad.
All right.
So let's go back and restart and analyze again.
So let's enter the username "CRAK."
Hit Enter.
And run again.
Step into this.
Step over.
Run to here.
Step into this.
Step over.
Run to this.
Run again.
Step into this.
Step over.
OK, so now this is where it checks for the actual username.
And remember, this line sets it to one.
OK, so before that, it passes a few parameters for this call up here.
So let's see what's happening.
OK.
As you can see, it is moving this to -. Step.
This is - now. It has got this four-character "NICK."
This is the username.
And then it moves our username to here.
Great.
So now it's got two parameters on the stack.
Two parameters.
"CRAK" and "NICK" on the stack.
Ready for this call.
So from here we can more or less deduce that the username is "NICK."
"NICK."
Because after this call, it returns one.
One means that it's a wrong username.
So based on that hypothesis, let's try to enter "NICK" and see what happens.
All right.
So let's rerun.
Run again.
Enter the username:
"NICK."
Hit Enter.
Step into.
Just run again.
Step into this.
Step over.
Run to this line.
Line.
So run over there.
Step into this.
Step over, and then run to that line again.
Step into this.
Step over.
OK.
So now
let's see what happens when it comes to this line.
This line where it compares your input.
You can see input.
OK.
What happens after this call?
- becomes zero.
That means we correctly—
we were right in assuming that "NICK" is the username.
OK.
So
return.
Let's return to the main function.
OK, we are now in the main function. Yet we are in the string compare function.
Let's execute till return.
And step over to go back to our main.
Are we in main?
Not yet.
We are in this function.
Execute till return.
Just step over and see.
Are we in the main function?
Yes, we are now in the main function.
So now we can graph this and you can see what's happening.
So now we are here.
Let's see if we jump to the left or to the right.
So it is now one.
Previously it was zero.
That means it's going to go to the right.
That means our username is correct.
Previously it went over to the left and said "User not registered."
So now it's going to go to the right.
Let's click on this. Jump not taken.
So jump not taken means that it is not going to take this jump to 5D9.
It's going to go to the right.
So it's going to the right.
And this time
look, after this call,
after this call, it puts up the prompt for the password.
OK.
So we don't know what's the actual password.
So we can just put a fake password.
It is not waiting for input yet.
So let's continue to step over until this thing becomes running.
See, it is now running, so now it's waiting for input.
So now we type our password: "cracking lessons."
Hit Enter. OK, so let's step over.
Wait for a wrong error message.
OK.
It looks like from here it has gone into our function.
Click on -, and we are now here. It's comparing the password itself now.
All right.
So I'll continue with this in the next lesson.
In this lesson, we successfully fished out—traced the username. In the next lesson, we are going to trace
the password.
See you in the next one.
Thank you.