1

I'm trying to solve a crackme that contains a key check like so:

    lVar4 = vulnerability1(passwd);
    if (lVar4 == 0x260a4c7d7af23fc0) {
      solve_check(1,0xffffffff);
      free(passwd);
      uVar3 = 1;
    }

with childhood vulnerability being

long vulnerability1(char *param_1)

{
  char *local_20;
  long local_10;


local_10 = 0x7364626d;
  local_20 = param_1;
  while( true ) {
    if (local_20 == 0) break;
    local_10 = local_10  0x1003f + (long)(int)*local_20;
    local_20 = local_20 + 1;
  }
  return local_10;

}

Basically, vulnerability1 cycles through each letter of param1 and applies some transformations. It returns this transformation and it must be the value 0x260a4c7d7af23fc0

My question is: Is there an more "correct" way of finding the correct string besides brute force? How would a veteran RE person do this?

efel
  • 111
  • 1
  • looking at decompilation alone without accompanying disassembly is not a good practice from the looks of it a longlong needs to be returned by a long multiplied with a const doesn't look feasible the overflow will get lost. – blabb May 27 '23 at 10:43
  • Apologies, should of mentioned the architecture and os. This is 64 bit Intel, Linux. So long would be 8 bytes. – efel May 27 '23 at 11:40

0 Answers0