Tryhackme — Reverse Engineering

1.crackme1

hint :- did you check the strings stored in the executable?

./crackme1.bin

chmod 777 crackme1.bin

Now I have the answer.

strings crackme1.bin

Let’s debug,

r2 -d ./crackme1.bin

and ..Analyze command — aaa then afl is list of functions and There’s a main function.

There’s password declaration and strcmp function.

pdf @main

Let’s look into variable’s value.

Set breakpoint at strcmp

db 0x56163a9737c7

dc

pdf @main

Now I have breakpoint.

px @ rsi

There’s a password.

#1 :- what is the correct password?

Answer :- hax0r

2.crackme2

Run the program

./crackme2.bin

strings ./crackme2.bin

Let’s debug,

r2 -d ./crackme2.bin

There’s a main function.

There’s comparison with value.

Convert from hexa to decimal

#2 :- What is the correct password?

Answer :- 4988

3.crackme3

Run the program,

./crackme3.bin

Let’s debug,

Run another step…..

ds
pdf @main

Let’s check the value

Variable “var28_h” is “rbp-0x28”.

px @ rbp-0x28

I just try to answer this and it’s correct.

#3 :- What are the first 3 letters of the correct password?

Answer :-azt