> For the complete documentation index, see [llms.txt](https://e13v3n-0xb.gitbook.io/myspace/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://e13v3n-0xb.gitbook.io/myspace/writeups/reversing.kr-writeup/easy-crackme.md).

# Easy Crackme

Writeup for Easy Crackme from Reversing.kr

## Overview

Hola Amigos!!

Today I am trying the first crackme from [***reversing.kr***](http://reversing.kr/challenge.php) marked as *100* points. It's a simple window crackme that uses some string comparisons to check and validate the input string. 

Here is my little attempt to solve the first challenge. 

I will be just using IDA freeware coz I am too broke to use IDA Pro. So, IDA Free all the way !!!!

## Walkthrough

So, First thing first. I am going to run this executable to check its functionality.

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2FMHZQ7YTfdcbG9409qojD%2FEasyCrackme.png?alt=media\&token=d0b393a7-7fa3-4d1e-a95a-97eb3a684549)

On executing, it gives us an dialog box which contains an input field to enter a string. 

Let's input some gibberish string to check. 

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2FTLEww6CiIhDAUlk61Pfy%2FEasy_CRackme_2.png?alt=media\&token=01391605-1634-410a-9442-6f474e520f5e)

So, It seems like a password checker. Alright, now we know we have to enter a password, And if the password is wrong, it will give us a pop-up "***Incorrect Password***".

So, let's open this binary in IDA Freeware. We already know the executable create dialog box. So, I am going to trace the call for the **DialogBoxParam**(WIN32 API to Creates a modal dialog box) in IDA.

### Inspecting the file with IDA

On opening the file in IDA. We can see the call to the **DialogBoxParam** with the field **lpDialogFunc** having the function name **DialogFunc**. This function seems like it can help us and might be responsible for the input validation.

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2F308lbvZKddAmQ5XrireR%2FeASY_crackme_ida1.png?alt=media\&token=6bc93cca-ba4d-4399-ac78-f67b5c5776d0)

### Inspecting DialogFunc

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2FAaMVXiXaozHCXqLFWkvy%2Flpdialog.png?alt=media\&token=de3a152f-8434-4f9a-a1b4-91d50f4599d0)

On opening the DialogFunc in the graph, we can see a branch ***`loc40105E`*** calling t*he **En*****dDialog** API which will invoke when the Dialog box closes. So, we dont wanna go there. 

The other branch ***`loc4041049`**  could be our main functionality as it makes a call to another function **`sub_401080`*** which seems interesting as it pushes ***Dlg***(handle of the dialog box) just before it. 

### Inspecting function sub\_401080

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2FRpgU994oSKxC5t8k862P%2Flpdialog.png?alt=media\&token=1ef50947-ba0e-4845-9dcd-a05ae9e3e9d7)

On inspecting the function ***`sub_401080`** we see a call to **GetDlgItemText*** which implies that it takes the input from the dialog box and put it into a string. And if we will just look at the stack variable on top, we have four variables ***`string`***, ***`var_63`**, **`var_62`*** and ***`var_60`***.

These variables are kind of too close to each other with respect to their offset. So, it seems like the variable ***`string`*** is the first part of the password, ***`var_63`*** is one byte down from ***`string`***. So, ***`var_63`*** must be ***`string[1]`***  and same with ***`var_62`*** and ***`var_60`***. So, we can conclude :

`var_ 63 = string[1]` 

`var62 = string[2]`

`var60 = string[3]`

 So, we can assume that our password is the concatenation of 4 variables.

> #### `password  = string + string[1] + string[2] + string[3]`

I am going to rename these variables in IDA for ease and we will move ahead.

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2FzbqbIGKGA5DNIY8XFKjJ%2Fcompare.png?alt=media\&token=259c0183-3eb2-4f86-a677-6a4f64b64027)

So, Just after the call to ***GetDlgItemText***, we see a comparison of the byte stored in ***`string[1]`*** with **61h**(ASCII Value = '**a**'), If the check succeeds we move further in our code else it gives us a pop-up "***Incorrect Password***". Now we have our initial finding that our second variable contains '**a**'.

Moving on to the  next branch we see, our ***`string[2]`*** is pushed as parameter followed by a string "***5y***", and then it calls to function ***`sub_401150`***, which basically checks if our ***`string[2]`*** is equal to "***5y***" or not.

Hence, we got the value of our third variable which is "***5y"***. 

So, far we have:

> ***`password  = *a5y*`** (\* = wildcard)*

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2FqTrLKLOJu5RiaAIbmHOa%2Fcmp_3.png?alt=media\&token=ba8e4911-0520-4a31-8f15-f5f211e1cf22)

In the next branch, we see a string "***R3versing***" is passed into ***`esi`*** and our ***`string[4]`*** is passed into ***`eax,`*** which further goes into string comparison loop which checks each character of ***`string[4]`*** matches with "***R3versing***" or not. Hence, we got the last part of our password too. Now, we are left with the first part.

> ***`password  = *a5yR3versing`*** (\* = wildcard)

Lets move forward,

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2FNpVVcjznnVNbOG1VfQEt%2Flast.png?alt=media\&token=cf78df2f-4572-42fb-a5ec-f7c9393a0c94)

Finally, we are checking the first character ot string with ***`45h`***(ASCII = '***E***'). If they are not equal we get a pop-up of "***Incorrect Password***", else we get the "***Congratulation !!***" message.

### Flag

Well well well! Look how far we have come. Its time to summarize all of our effort and submit our password.

> ***`password = Ea5yR3versing`***

![](https://1392872857-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcuMhimRIglK2VWOppJXk%2Fuploads%2Fe8Bd7MII9dBgA4FkXEac%2Ffinal.png?alt=media\&token=46b64dbb-e795-4c55-bef5-2a9883384320)

And, Voila!! Sweet Victory message. Give a pat to yourself for reaching the end. :clap:

Adios, Keep solving more crackmes!!!