winapi - Can't seem to figure out how this works -


i'm trying determine password in challenge code, can't figure out how works. have tips on how go figuring out does?

.text:00401000                 public start .text:00401000 start: .text:00401000                 mov     esi, offset loc_401013 .text:00401005 .text:00401005 loc_401005:                             ; code xref: .text:00401011j .text:00401005                 cmp     esi, offset byte_40105f .text:0040100b                 jz      short loc_401013 .text:0040100d                 xor     byte ptr [esi], 0cdh .text:00401010                 inc     esi .text:00401011                 jmp     short loc_401005 .text:00401013 ; --------------------------------------------------------------------------- .text:00401013 .text:00401013 loc_401013:                             ; code xref: .text:0040100bj .text:00401013                                         ; data xref: .text:starto .text:00401013                 xor     bl, al .text:00401015                 test    eax, 44cd8dfdh .text:0040101a                 or      eax, edx .text:0040101c                 jnp     short near ptr 400fe1h .text:0040101e                 db      2eh .text:0040101e                 .text:00401020                 mov     esp, [esi] .text:00401022                 xor     eax, 9936b34ch .text:00401027                 mov     edi, 0dbb8a8b8h .text:0040102c                 cmpsd .text:0040102d                 int     0a5h            ; used basic while in interpreter .text:0040102f                 sub     ebp, 0cda5cd8dh .text:00401035                 in      eax, dx .text:00401035 ; --------------------------------------------------------------------------- .text:00401036                 dw 0cd8dh .text:00401038                 dd 0d832cda7h, 0cd8dfd55h, 0cda7d926h, 8ded81a5h, 0ededa5cdh .text:00401038                 dd 0cda7cd8dh, 0fd55d832h, 0cda7cd8dh, 0fda5d832h .text:0040105c                 db 8dh, 0cdh, 0eh .text:0040105f byte_40105f     db 0eeh                 ; data xref: .text:loc_401005o .text:00401060                 dd 90eeeeeeh, 90h, 66h dup(0) 

the code xors each byte loc_401013: byte_40105f 0xcd, jumps start of code, makes disassembly meaningless. see code doing, you'd need xor each byte in range 0xcd , re-disassemble it.


Comments

Popular posts from this blog

linux - xterm copying to CLIPBOARD using copy-selection causes automatic updating of CLIPBOARD upon mouse selection -

c++ - qgraphicsview horizontal scrolling always has a vertical delta -