MagicValuePass = (((password&(0xff>(8*idx))^ (32 * 0xadde + 1) ^ 0xdeadbeef) & 0xffffffff

MagicValuePass = BitVec('magicValuePass',64) Z3 is a great tool that will help you in such simple tasks with APIs in all major languages. I thought about reversing magicValuePass generation but but came to conclusion that's a bad idea.Īs you have just started into RE, try looking into SAT solvers. In the end we get magicValuePass = 0xa8a17eee which is the same value we get for login so the password is correct. The output of this function is following: Byte: 01 MagicValuePass = passByte ^ (32 * magicValuePass + 1) ^ 0xdeadbeef multiplication by 32 is left shift for 5 bytes We go through every byte from left to right and calculate new magic value. Then we convert string representation to hex and aplly this algorithm: Password should be at least 12 chars and should contain only'a'-'f', 'A'-'F', '0'-'9'. login = 'Vasya_Pupkin'ġ) From login we get two first chars ('Va') and two last ('in') and write its ASCII-code into hex number: V = 0x56, a = 0圆1, i = 0圆9, n = 0圆eĢ) We go through the login string and add up all ASCII-codes: for (int j = 0 j < login.length() j++)ģ) We xor those values with some number 0xfec0135a: hexVain ^ asciiSum ^ 0xfec0135a

I've figured out both algorithms with IDA and wrote a program in C++ to test my solutions. I'm trying to find a way to generate a correct password for any given login. And if the two numbers are equal, then the password is correct. In both cases we get a number as a result. I've spend a couple of days trying to solve it but I can't. I'm a newbie who just started own way through reverse engineering so I apologize if my question is not appropriate.Ĭurrently I'm going through different Crackme puzzles and now I'm stuck.

Password generator algorithm