Bomb 💣

Before even opening IDA, I used PE Studio to extract some preliminary information that I will use later. The first thing that I checked was the strings section:

There are some interesting strings in here: some format strings maybe used for formatting input or output, the indication of a secret stage and some cryptic strings that sound a little bit strange like: isrveawhobpnutfggiants and Public speaking is very easy.. Also there are a couple of error messages regarding EOF and an too long input line.

I executed the binary to see how the program looked like. It is a simple CLI application that present itself with a nice text and then wait for an input.

Let’s try to trigger the “input too long” error:

After those trivial attempts let’s fire up IDA.

sub_401960 is easy to understand, this is the function responsible for the exoplion of the bomb. Nothing more, nothing less. Let’s call this function BOOM.

The first function call I saw in the first stage was to sub_401740. This sub is a little bit more complex that the BOOM one, but we can easily see that:

• It takes two arguments
• The same function is called twice at the beginning and the return values are compared
• There is a loop
• and just one path lead to a zero output, all the other return 1.

Before entering into the details of what the function that is called at the beginning does I considered the code that is executed is the compare is successful. First of all two local variables are initialized with the content of the two arguments provided here:

Then the loop starts, at each iteration the loop takes the content of the first local variable and checks if its zero (string termination pheraps?) if not it checks if the content of the memory pointed by the two local variables is equal, increase by one the content of the local variables (iterates over a string?) and the loop restarts.

Coming back to the two calls to the same function let’s inspect sub_401700. This sub is quite simple:

• Takes one argument
• Initializes a local variable with 0, let’s call it idx
• Initializes a local variable with the content of the argument, let’s call it input
• deferences the content of input
• checks if the content is 0, and if not
  • increase the value of idx by one, and also increase the content of input by one (iterates over a string?).
• the sub returns idx.

I’m quite confindent that this functions returns the number of ASCII characters in a string, so I called it homemade_strlen. Now everything seems more clear, first the function calls homemade_strlen on both its argument and compare the respective return values, then the sub compares the two arguments byte by byte and checks if they are equal, if just one byte mismatch or the two argumets have different lenght it returns 1: we have a freshly baked homemade_strcmp. Back to phase one.

With just a couple of renames and everything seem more clear.

The phase one sub just compares the user input with the string literal “Public speaking is very easy.”. One phase’s defused, five more left.

sub_4016B0 is responsible of the formatting of the content of the Buffer viariable:

and fill an array of six integers

After the input handling phase, the sub checks if the first input is 1, and then it proceeds with a loop. The loop starts from 1 until 6, and inside its body a condition is checked, if the conditionis not verified th ebomb explodes.

It is clear that it checks that the content of the usr_input array respects some kind of property, but there is one dubt still left: what does Var_20 do? Var_20 is recognized as a local variable by IDA, but in reality it was put there by the compiler as an optimization trick. In fact, at each iteration the user_input array is acessed twice:

1. at the current position pointed by the idx variable, and
2. at offset Var_20, that is -20h (-32 in decimal). This means that we are accessing the array at position idx - 1.

We have to contstruct the array with respect to that condition, given that the first number should be 1.

This phase was quite simple: 3 k 251 can be used as an input to solve it.

sub_401350 starts with a compare between the argument, and one, if the argument is less or equal than one it just returns one, else if the argument is greater than one the function:

• subtracts one from the argument
• pass the new value to another call of itself, stores the return value in register esi, then
• subtracts two from the argument and pass the new value to another call of itself, the return value is in eax, finally
• adds the two obtained values and then returns the just computed sum.

Yes, this sub computes the fibonacci from the second element up two an nth element given in input.

The return value of sub_401350 is compared with 37h, 55 in decimal. So our solution is the position of the number 55 in the fibonacci sequence, starting from the second element of the sequence itself.

My goal is to find a string such that the result of bitwise AND between the ASCII value of the characters with 15 will produce those indexes in order. But the bitwise AND does nothing more than extracting the last byte and obtaining a number between 0 and 15.

There are multiple solutions for this phase, I used ?05;=1 as passphrase to solve this phase, but other strings can be used.

The first thing that the function does is to call sub_4016B0, this function takes the Buffer that contains the user input and uses sscanf to fill Var_20, then checks if the number of integers is greater than six.

After the input handling phase, a loop begins.

The body of this loop looks a little bit intimidating, let’s break it in small parts. Firs of all the loop it’s iterating over the user input, in the first conditional statement checks if the element in the position currently indexed is greater or equal than one, the second conditional statement checks if the element currently indexed is les or equal than six:

So all the input numbers must be integers between 1 and 6. After this preliminary check, an internal loop is started, this time the loop starts from the current index plus one and iterates until the end of the array. At each iteration this inner loop checks that the number pointed by the outer loop’s index is different for all the following numbers. In summary the inner loops checks that all the number in the array are different.

So the first loop of the sixth phase checks that all the six numbers taken in input are integers between one and six and that are all different.

After the first loop, a second one begins, let’s uderstand what it does. In this loop a second array is filled with some pointers, the order of the elements of the array is given by the numbers inside the user input array. At each iteration of the loop:

• Var_4 is initialized with the value contained in Var_3C,
• idx2 is initialized with one, and
• if the value of idx2 is greater then the element currently indexed by idx in the user input array then:
  • the value of Var_4 is inserted in position idx of a newly constructed array.
• else:
  • it adds 8 (moves up a byte) to Var_4 and increase idx2

So at the end of this first loop we have contructed this array. Let’s inspect the .data section:

Now I know what the addresses point to, going back to the code, I saw that, and the end of the sub_401460

the code checks if the value pointed by the element currenlty considered in the previusly constructed array is greater than the value pointed by the next pointer in the array. Using this information and the values I saw inspecting the .data section It’s possible to deduce that the correct order is:

When solving the last phase I didn’t analyzed what the second loop considered in Cracking the code part did.