Tetstack
Відкрити в Telegram
My Archive? IDK Owner: https://www.github.com/PicasoTheDeal Portfolio: https://isitreallyme.pages.dev Blog: https://engineering-logs.pages.dev/ Files: @TetstackFiles
Показати більшеКраїна не вказанаКатегорія не вказана
237
Підписники
+324 години
+47 днів
+1730 днів
Архів дописів
237
ghidra did unsigned substraction so .... local_70 is the string length, the expression length_70 - 5U is unsigned
237
so I finalized it to this code that's the logic I suppose if you enter any character longer than 5 it exits with that message and then the next one is the number you type must be equal to the checksum of your string..
237
undefined8 FUN_001011f0(void) {
int iVar1;
ostream *poVar2;
long in_FS_OFFSET;
int local_7c;
undefined1 *local_78;
long local_70;
undefined1 local_68 [16];
string local_58 [40];
long local_30;
local_30 = *(long *)(in_FS_OFFSET + 0x28);
local_78 = local_68;
local_68[0] = 0;
local_70 = 0;
poVar2 = std::operator<<((ostream *)std::cout,"Enter a string of characters (no spaces): ");
FUN_00101430(poVar2);
std::operator>>((istream *)std::cin,(string *)&local_78);
if (5 < local_70 - 5U) {
std::operator<<((ostream *)std::cout,"Bro, what are you trying to do?");
FUN_00101430();
/* WARNING: Subroutine does not return */
exit(0);
}
poVar2 = std::operator<<((ostream *)std::cout,"Enter correct number (no spaces): ");
FUN_00101430(poVar2);
std::istream::operator>>((istream *)std::cin,&local_7c);
std::__cxx11::string::string(local_58,(string *)&local_78);
iVar1 = FUN_001014b0(local_58);
std::__cxx11::string::_M_dispose();
if (local_7c == iVar1) {
poVar2 = std::operator<<((ostream *)std::cout,"OMG! You did it! :3");
}
else {
poVar2 = std::operator<<((ostream *)std::cout,"Send help pls.");
}
FUN_00101430(poVar2);
std::__cxx11::string::_M_dispose();
if (local_30 == *(long *)(in_FS_OFFSET + 0x28)) {
return 0;
}
/* WARNING: Subroutine does not return */
__stack_chk_fail();
}
so which means I missed smthing here237
DAT_00104020 XREF[2]: FUN_001014b0:001014c4(*),
FUN_001014b0:001014d5(R)
00104020 04 00 00 00 undefined4 00000004h
DAT_00104024 XREF[1]: FUN_001014b0:001014d5(R)
00104024 4f 00 00 00 undefined4 0000004Fh
00104028 81 db 81h
00104029 00 ?? 00h
0010402a 00 ?? 00h
0010402b 00 ?? 00h
0010402c ab ?? ABh
0010402d 00 ?? 00h
0010402e 00 ?? 00h
0010402f 00 ?? 00h
But there are 2 XREF sooo wait ...237
so after checking the table is not an array of char but an array of unit(4 bit each) they are 32-bit integers
237
00104028 81 db 81h
00104029 00 ?? 00h
0010402a 00 ?? 00h
0010402b 00 ?? 00h
0010402c ab ?? ABh
0010402d 00 ?? 00h
0010402e 00 ?? 00h
0010402f 00 ?? 00h
00104030 fe ?? FEh
00104031 00 ?? 00h
00104032 00 ?? 00h
00104033 00 ?? 00h
00104034 7b ?? 7Bh {
00104035 00 ?? 00h
00104036 00 ?? 00h
so this are the first 15 byte now gotta find a way
