Welcome back.
In our next crackme,
which is C3,
we are going to take a look at how to use the understanding of ASCII code and hex numbers to solve it.
So if you want to give it a try,
please pause the video and give it a try.
So this is how I solve it.
Drag C3 into our session one.
It has detected an ELF format,
64-bit.
This is the result of the import.
Okay.
Directory into the code browser to begin the process of analysis.
Click
Yes
to analyze.
Click
Analyze.
Watch the bottom right corner
to see when it has completed.
Now it has completed the analysis.
Head over to the symbols table and expand on the functions folder and look for the main function.
Head over to the decompile window.
And this is your main function.
Let's change the signature of the main function.
Let us rename this first parameter as argc.
And the second parameter
as char star
star argv.
Okay. Now we'll try to run the crackme.
Go to the desktop and open the crackme
directory.
Open the terminal here.
And let's run C3.
C3 without any parameters will yield the string
"Please provide the secret password."
Go back to the Ghidra code browser and you will see,
yeah,
C3, if it is run without any parameter, will use this message:
"Please provide the secret password."
Click on the terminal again.
This is because of the check here.
If 0x2 is not true, then it will show this message.
So because argc in this case is one, so this condition is not satisfied and it jumped to the else part
to show this message.
Now we will provide an argument,
three A's.
And now we see a different string.
This time we have satisfied the condition for 0x2.
0x2 is true.
So this is true.
And so it enters the block and does these instructions.
The first line, it will get the string, string length.
And then over here, you store the string length to this variable as iVar2.
Therefore, we know that iVar2 is a length. Let's rename it
to length.
Our pcVar1 is the parameter we pass
to the program, which is the string A A A.
If the length is less than five,
then it will show this string which is appearing here.
Now the length of our string is three.
So this is true.
That is why it is showing this.
So let us try now with length
of five.
Since it is expecting the password to be five characters or more.
So we type in five A's, and this time we get a different string as the message.
So in this case, now this test is false, so it skips the if part and goes to the else part and performs
this second test.
Now in this second test, it will minus this
from here.
And see whether the result is 0x20.
So it is trying to extract the third character of your password
and then minus that from the fourth character of your password.
And check to see whether the result is 0x20. 0x20 is hexadecimal,
and we can convert it into
decimal
by using a programmer's calculator.
So we select hex to zero.
Convert into decimal is 32.
That means it is taking the third character,
minusing the fourth character, and see whether the result is 32.
So how can a third character minus a fourth character give you 32?
The answer is,
if the third character is an alphabet
and fourth character is also an alphabet.
So an alphabet minus another alphabet, it means that we are minusing the ASCII code.
Every character is encoded with the ASCII code.
So the character for every alphabet has a corresponding ASCII code,
as you can see here.
So if your first character is 97,
97
minus what gives you 32?
That is the equation we need to solve.
If the first character, if the character here is 'a',
and the fourth character is a question mark,
so 'a' minus question mark,
what character should this question mark be
so that you can get 32?
If you look at the ASCII code,
'a' is 97.
So 97 minus what gives you 32?
You can solve it as an equation.
So in order to know what is the question mark, we can solve it this way.
The question mark is equals to 'a' minus 32, and that gives you capital A over here. Capital A is 65.
'a' is 97.
97 minus 32 gives you 65.
So
97
minus
32 gives you 65.
So 65, you look here, is capital A.
So to solve it,
'a' minus question mark equals 32 is actually
'a' minus capital A. That gives you 32.
So using this and replacing it back in here,
that character is lowercase
'a', fourth character is uppercase 'A', and we get this as the password.
One, two, lowercase
'a', uppercase
'A', four, five.
What is important is these two.
One and two, four and five can be any number or any character.
It doesn't matter.
What matters is that your third character minus the fourth character must be 32.
So you can have more than one answer.
It doesn't have to be 'a' and uppercase 'A'.
It could also be other combinations of ASCII characters, so long as the difference between them is
32.
So let's try this out to see if it's correct.
I will try this again.
This time I'm going to put one, two, lowercase 'a', uppercase 'A', four, five.
And this time we see a different message, which is coming from here.
Correct.
You figured it out.
So this is how we can use the understanding of ASCII code and hex numbers in order to solve this crackme.
That is all for this video.
Thank you for watching.