lab 4-1

IDA pro 打开文件:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
int __cdecl main_0(int argc, const char **argv)
{
  int result; // eax

  if ( argc == 2 )
  {
    if ( !j_strcmp(argv[1], "topsecret") )
      printf("You found the password!  Congratulations!\n");
    else
      printf("Fail!\n");
    result = 0;
  }
  else
  {
    printf("Usage: crackme-123-1 password\n");
    result = 1;
  }
  return result;
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
.text:004113C2                 push    offset Str2     ; "topsecret"
.text:004113C7                 mov     eax, [ebp+arg_4]
.text:004113CA                 mov     ecx, [eax+4]
.text:004113CD                 push    ecx             ; Str1
.text:004113CE                 call    j_strcmp
.text:004113D3                 add     esp, 8
.text:004113D6                 test    eax, eax
.text:004113D8                 jnz     short loc_4113F5
.text:004113DA                 mov     esi, esp
.text:004113DC                 push    offset aYouFoundThePas ; "You found the password!  Congratulation"...
.text:004113E1                 call    ds:printf
.text:004113E7                 add     esp, 4
.text:004113EA                 cmp     esi, esp
.text:004113EC                 call    j___RTC_CheckEsp
.text:004113F1                 xor     eax, eax
.text:004113F3                 jmp     short loc_41140E

通过查看汇编代码,发现只要将第8行的 jnz short loc_4113F5 改为 jz short loc_4113F5 即把判断条件反转即可做到输入随机字符串可通过认证。