Since this challenge has 0 protection we can easily solve it by searching for the string in the strings window of IDA.
Select from the menu: View -> Open Subviews -> Strings then double click on the:
.rdata:00404053 0000000D C Gratz man 🙂
Now you should be in the .rdata section on the binary, while the string is still selected, right click on it and click on: Xrefs graph to… this will give you a nice graph that you can look at.
There should be 3 functions: Main -> SUB0 -> SUB1. Find the SUB1 function in the functions window and double click on it.
Here you can see a the following data:
[code]
.text:00401726 interrestingFunction2 proc near ; CODE XREF: interrestingFunction1+35↓p
.text:00401726
.text:00401726 Format = dword ptr -28h
.text:00401726 var_C = dword ptr -0Ch
.text:00401726 arg_0 = dword ptr 8
.text:00401726 arg_4 = dword ptr 0Ch
.text:00401726
.text:00401726 push ebp
.text:00401727 mov ebp, esp
.text:00401729 sub esp, 28h
.text:0040172C mov [ebp+var_C], 0
.text:00401733 cmp [ebp+arg_4], 7 ; The password is 7 characters long.
.text:00401737 jnz short loc_4017AA ; the wrong password location
.text:00401739 mov eax, [ebp+arg_0]
.text:0040173C movzx eax, byte ptr [eax]
.text:0040173F cmp al, 'S' ; Here's the begining of the password.
.text:00401741 jnz short loc_4017AA
.text:00401743 mov eax, [ebp+arg_0]
.text:00401746 add eax, 1
.text:00401749 movzx eax, byte ptr [eax]
.text:0040174C cmp al, 'P'
.text:0040174E jnz short loc_4017AA
.text:00401750 mov eax, [ebp+arg_0]
.text:00401753 add eax, 2
.text:00401756 movzx eax, byte ptr [eax]
.text:00401759 cmp al, 'a'
.text:0040175B jnz short loc_4017AA
.text:0040175D mov eax, [ebp+arg_0]
.text:00401760 add eax, 3
.text:00401763 movzx eax, byte ptr [eax]
.text:00401766 cmp al, 'C'
.text:00401768 jnz short loc_4017AA
.text:0040176A mov eax, [ebp+arg_0]
.text:0040176D add eax, 4
.text:00401770 movzx eax, byte ptr [eax]
.text:00401773 cmp al, 'I'
.text:00401775 jnz short loc_4017AA
.text:00401777 mov eax, [ebp+arg_0]
.text:0040177A add eax, 5
.text:0040177D movzx eax, byte ptr [eax]
.text:00401780 cmp al, 'o'
.text:00401782 jnz short loc_4017AA
.text:00401784 mov eax, [ebp+arg_0]
.text:00401787 add eax, 6
.text:0040178A movzx eax, byte ptr [eax]
.text:0040178D cmp al, 'S'
.text:0040178F jnz short loc_4017AA
.text:00401791 mov eax, offset aGratzMan ; "Gratz man :)" ; the password confirmation message
.text:00401796 mov [esp+28h+Format], eax ; Format
.text:00401799 call printf
.text:0040179E mov [esp+28h+Format], 0
.text:004017A5 call exit
We can see that arg_0 is a pointer to a bytes array, we can assume that arg_4 is the length of the array. Below you can see that arg_0 is compared to the password byte by byte. In order to convert to char from hex and back and forth, select the line and press the key R.
Thanks for reading, happy hacking!