winapi - Can't seem to figure out how this works -
i'm trying determine password in challenge code, can't figure out how works. have tips on how go figuring out does?
.text:00401000 public start .text:00401000 start: .text:00401000 mov esi, offset loc_401013 .text:00401005 .text:00401005 loc_401005: ; code xref: .text:00401011j .text:00401005 cmp esi, offset byte_40105f .text:0040100b jz short loc_401013 .text:0040100d xor byte ptr [esi], 0cdh .text:00401010 inc esi .text:00401011 jmp short loc_401005 .text:00401013 ; --------------------------------------------------------------------------- .text:00401013 .text:00401013 loc_401013: ; code xref: .text:0040100bj .text:00401013 ; data xref: .text:starto .text:00401013 xor bl, al .text:00401015 test eax, 44cd8dfdh .text:0040101a or eax, edx .text:0040101c jnp short near ptr 400fe1h .text:0040101e db 2eh .text:0040101e .text:00401020 mov esp, [esi] .text:00401022 xor eax, 9936b34ch .text:00401027 mov edi, 0dbb8a8b8h .text:0040102c cmpsd .text:0040102d int 0a5h ; used basic while in interpreter .text:0040102f sub ebp, 0cda5cd8dh .text:00401035 in eax, dx .text:00401035 ; --------------------------------------------------------------------------- .text:00401036 dw 0cd8dh .text:00401038 dd 0d832cda7h, 0cd8dfd55h, 0cda7d926h, 8ded81a5h, 0ededa5cdh .text:00401038 dd 0cda7cd8dh, 0fd55d832h, 0cda7cd8dh, 0fda5d832h .text:0040105c db 8dh, 0cdh, 0eh .text:0040105f byte_40105f db 0eeh ; data xref: .text:loc_401005o .text:00401060 dd 90eeeeeeh, 90h, 66h dup(0)
the code xors each byte loc_401013:
byte_40105f
0xcd, jumps start of code, makes disassembly meaningless. see code doing, you'd need xor each byte in range 0xcd , re-disassemble it.
Comments
Post a Comment