Hello and welcome back.
In this video, I will show you how to analyze this code and solve it.
In the previous lesson,
we have already determined that
the
length will extract the length of the password which you key in.
So the length variable, which I've already renamed it to, stores the length of the password which
you keyed in. In the next line,
it compares whether it is less than five.
So if your password length is less than five, it will show the message,
"We never use a password that short," and that is what happened in this example when we keyed in a password
length of only three characters.
It showed this message.
That suggests that the password is five characters or more.
And so in this next session here, we try the password, which is more than five characters.
This time it got a different message.
So
it went on into the else part and did some checking.
And this time when it checked your password, it was checking to see whether the first character of
the password begins with the letter H and whether the fifth character of the password begins with the
letter U.
So this is the first character.
This is the first character of the password, and this is the fifth character of the password.
Let me explain how it works using Notepad.
When you enter your password, it will be stored in
argv[1].
Assuming your password is
A, A, A, A, A, A,
the first character of the password is argv[1]
[0].
Let me use a different password.
Let's say you have entered A, B, C, D, and E.
So the first character of the password is a character
A. The second character of the password is argv[1][1], which is B. The third character of the password
is argv[1][2], which is C.
The fourth character of the password is argv
[1][3],
which is D.
And
the fifth character of the password is argv[1][4], which is E.
This is the notation in C language for two-dimensional array.
A two-dimensional array is just an array of strings.
So the first string is argv[0], which is the name of the program, which is C2.
argv[0] is the name of the program
itself.
That is how it works.
And to make it complete, I will just list down argc.
So in this
crackme, argc is two because it has two parameters: C2 and the string for your password.
And then in the string itself, there are
two strings.
The name of the program is the first string, which is argv[0], and it is C2
in this case, whilst the second parameter, the second string is argv[1], which is the password you
key in.
In this case, an example would be ABCDE.
Assuming, let's assume you have, you had typed A, B, C, D, E.
So this is the meaning
of argc
and argv.
So in this case, in line 15, after it has confirmed that you have keyed in a password of at least five
characters, it went on to check whether your first character is H.
But notice here it doesn't use argv[1][0].
argv[1][0] is supposed to refer to the first character.
Instead, it uses a star in front.
It is actually the same thing.
So another way to refer to the first character of a string is to use a star in front of argv[1].
So this also refers to the first character of the string.
It's the same thing.
Then this is a logical AND operator.
It means that both this condition and also the second condition must be true before the whole expression
is true.
So the first character must be H, and the fifth character must be U.
So four here
refers to the fifth character,
not the fourth character.
Why?
Because in C arrays,
the first element of the array begins with zero.
So the fifth element will be four.
So the first character of the string is element zero,
whilst the fifth element of the string is element four.
So this suggests that it is trying to check whether your password that you enter has H and U in the
first character and the fifth character.
So the password should be any password with the first character H and the fifth character U.
So you can type in any kind of password,
for example, five characters long with the first character
H. The second character can be anything you want.
But the fifth character must be a U.
So this is the password.
Let us check and confirm
that is correct.
So we are going to key in now H as a first character, followed by
and the fifth character,
we are going to put U and hit Enter, and we get a message saying it is correct.
"Maybe we should pay attention to more characters."
So this string is coming from here.
So if you had entered the correct password that satisfies the length of at least five characters and
also the first character must be H, fifth character U, then this condition is met, and it will puts the string,
"Correct.
Maybe we should pay attention to more characters."
So this is how we analyze and reverse and analyze
crackmes in Ghidra.
I hope this was easy to understand,
and that's all for this video.
Thank you for watching.