ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

It Told You the Password

Easy 15 pts

A crackme's key check, disassembled below. It transforms nothing and hides nothing: your input is compared directly against a hardcoded string with strcmp, and that string is loaded from a data address right there in the listing. Read the value it compares against — that is the flag.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

Find the call strcmp. Its two arguments are your input and the correct answer.

Hint 2

The correct answer is the string loaded into the second argument register just before the call.

Hint 3

The data section at the bottom shows that string's bytes. That is the flag.

The artifact

; --- check_key ---
  lea   rdi, [rbp-0x40]        ; your input
  lea   rsi, [rip+0x2f11]      ; -> data:expected
  call  strcmp
  test  eax, eax
  jne   .fail                  ; not equal -> reject
  lea   rdi, [rip+0x2f30]      ; "Access granted."
  call  puts
  jmp   .done
.fail:
  lea   rdi, [rip+0x2f40]      ; "Nope."
  call  puts

; --- .data ---
data:expected:
  db "nm{lea_the_flag_right_into_rsi}", 0

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.