Reverse engineering

A typical reversing challenge gives you a program that asks for a password. Give it the right one and it says "Correct!", and that password is the flag. You could never guess it, but the program must contain the logic for checking it. So you read that logic, and work backwards.

There are two ways to study a program, and good players use both:

Scripts in languages like Python or JavaScript ship as plain text, so you can read them directly. Here is a password checker. It builds the correct password piece by piece, which is meant to stop you spotting it. Read it the way a computer would:

def check(password):
    part1 = "zda{"
    part2 = "r3ad_"
    part3 = "th3_c0de}"
    return password == part1 + part2 + part3

guess = input("Password: ")
print("Correct!" if check(guess) else "Wrong.")

Authors rarely leave the answer sitting in the code. More often, the program scrambles your input and compares that to a stored value. The fix is to run the scrambling in reverse on the stored value. Read this one carefully:

SECRET = bytes.fromhex("504e4b51521a58755f444e1a1959751b5e5919464c57")

def check(password):
    scrambled = bytes(ord(ch) ^ 42 for ch in password)
    return scrambled == SECRET

In plain words: it XORs every character of your input with 42, then compares the result to SECRET. You learned in the crypto lesson that XOR undoes itself. So XORing SECRET with 42 must give you the password.

Your result appears here.

Programs written in languages like C are compiled into machine code before they ship, so you can't just read them. Don't panic. Work through these in order, because the easy ones often solve the challenge outright:

# 1. What is it?
file ./crackme

# 2. Does it contain any readable text? Often the password is right there.
strings ./crackme | grep -i zda

# 3. Run it, and spy on the library functions it calls.
#    If it compares passwords with strcmp, you can read the right answer here.
ltrace ./crackme

If those don't work, open it in Ghidra(opens in a new tab), a free tool that decompiles machine code back into something close to C. Variable names are lost, but the logic is all there:

undefined8 main(void) {
  char local_38[48];

  printf("Password: ");
  fgets(local_38, 48, stdin);
  if (strncmp(local_38, "zda{gh1dr4_s33s_4ll}", 20) == 0) {
    puts("Correct!");
  }
  return 0;
}