1
//...
2
  char local_98 [32];
3
  uint local_78 [28];
4

5
  local_78[0] = 0x25;
6
  local_78[1] = 0x2b;
7
  //...
8
  local_78[0x18] = 0x25;
9
  local_78[0x19] = 0x3c;
10
  local_78[0x1a] = 0xffffffbf;
11

12
  memset(local_98, 0x41, 0x1b);
13
  for (local_78[0x1b] = 0; local_78[0x1b] < 0x1b; local_78[0x1b] = local_78[0x1b] + 1) {
14
    local_98[(int)local_78[0x1b]] =
15
        (char)local_78[(int)local_78[0x1b]] + local_98[(int)local_78[0x1b]];
16
  }
17
  puts(local_98);
18
//...

1
local_78 = [0x25, 0x2b, 0x20, 0x26, 0x3a, 0x2d, 0x2e, 0x33, 0x1e, 0x33,
2
            0x27, 0x20, 0x33, 0x1e, 0x2a, 0x28, 0x2d, 0x23, 0x1e, 0x2e,
3
            0x25, 0x1e, 0x24, 0x2b, 0x25, 0x3c]
4

5
print("".join(chr(0x41 + i) for i in local_78))

1
//...
2
  if (param_1 == 2)
3
    iVar2 = strcmp((char *)param_2[1],"<password>");
4
    if (iVar2 == 0) {
5
      puts("Access granted.");
6
      giveFlag();
7
      uVar1 = 0;
8
    }
9
//...

1
//...
2
  int iVar1;
3
  undefined4 *puVar2;
4
  undefined4 *puVar3;
5
  char local_11f [51];
6
  undefined4 local_ec [51];
7
  uint local_20;
8

9
  puVar2 = &DAT_080486c0;
10
  puVar3 = local_ec;
11
  for (iVar1 = 0x33; iVar1 != 0; iVar1 = iVar1 + -1) {
12
    *puVar3 = *puVar2;
13
    puVar2 = puVar2 + 1;
14
    puVar3 = puVar3 + 1;
15
  }
16
  memset(local_11f, 0x41, 0x33);
17
  for (local_20 = 0; local_20 < 0x33; local_20 = local_20 + 1) {
18
    local_11f[local_20] = (char)local_ec[local_20] + local_11f[local_20];
19
  }
20
//...

1
(gdb) x/204xb 0x080486c0
2
0x80486c0:      0x25    0x00    0x00    0x00    0x2b    0x00    0x00    0x00
3
0x80486c8:      0x20    0x00    0x00    0x00    0x26    0x00    0x00    0x00
4
0x80486d0:      0x3a    0x00    0x00    0x00    0x28    0x00    0x00    0x00
5
0x80486d8:      0x25    0x00    0x00    0x00    0x1e    0x00    0x00    0x00
6
0x80486e0:      0x28    0x00    0x00    0x00    0x1e    0x00    0x00    0x00
7
0x80486e8:      0x32    0x00    0x00    0x00    0x34    0x00    0x00    0x00
8
...

1
byte = [0x25, 0x2b, 0x20, 0x26, 0x3a, 0x28, 0x25, 0x1e, 0x28, 0x1e,
2
        0x32, 0x34, 0x21, 0x2c, 0x28, 0x33, 0x1e, 0x33, 0x27, 0x28,
3
        0x32, 0x1e, 0x25, 0x2b, 0x20, 0x26, 0x1e, 0x33, 0x27, 0x24,
4
        0x2d, 0x1e, 0x28, 0x1e, 0x36, 0x28, 0x2b, 0x2b, 0x1e, 0x26,
5
        0x24, 0x33, 0x1e, 0x2f, 0x2e, 0x28, 0x2d, 0x33, 0x32, 0x3c]
6

7
print(''.join(chr(i + 0x41) for i in byte))

1
void processEntry entry(undefined4 param_1,undefined4 param_2) {
2
  undefined auStack_4 [4];
3
  __libc_start_main(FUN_080484f4, param_2,&stack0x00000004, FUN_08048d90,
4
                    FUN_08048e00, param_1, auStack_4);
5
  do {} while( true );
6
}

1
undefined4 FUN_080484f4(int param_1,undefined4 *param_2) {
2
    //...
3
    if ((sVar1 == 0x40) && (iVar2 = strcmp(__s_00,"<flag>"), iVar2 == 0)) {
4
        puts("Correct password!");
5
        return 0;
6
    }
7
    //...
8
}

1
undefined8 main(int param_1,undefined8 *param_2) {
2
  //...
3
  if (param_1 == 2) {
4
    compare_pwd((char *)param_2[1]);
5
  }
6
  //...
7
}

1
void compare_pwd(char *param_1) {
2
    //...
3
    builtin_strncpy(local_28,"I]{I\x14V\x17{WAGQV\x17{TS@",0x13);
4
    get_pwd((long)local_28);
5
    iVar1 = strcmp(local_28,param_1);
6
    if (iVar1 == 0) {
7
        puts("password OK");
8
    }
9
    //...
10
}

1
void get_pwd(long param_1) {
2
  undefined4 local_c;
3
  local_c = -1;
4
  while (local_c = local_c + 1, *(char *)(param_1 + local_c) != '\0') {
5
    *(byte *)(local_c + param_1) = *(byte *)(param_1 + local_c) ^ 0x24;
6
  }
7
}

1
local_28 = b"I]{I\x14V\x17{WAGQV\x17{TS@"
2
decoded = bytes([i ^ 0x24 for i in local_28])
3
print(decoded.decode())

1
undefined8 main(void) {
2
  //...
3
  builtin_strncpy(local_38,"OfdlDSA|3tXb32~X3tX@sX`4tXtz",0x1c);
4
  puts("Enter your input:");
5
  __isoc99_scanf(&DAT_00400966,local_58);
6
  iVar1 = strcmp_(local_58,local_38);
7
  if (iVar1 == 0) {
8
    puts("Good game");
9
  }
10
  //...
11
}

1
void strcmp_(char *param_1, char *param_2) {
2
  //...
3
  while( true ) {
4
    sVar1 = strlen(param_1);
5
    if (sVar1 <= (ulong)(long)local_1c) break;
6
    param_1[local_1c] = (byte)key ^ param_1[local_1c];
7
    local_1c = local_1c + 1;
8
  }
9
  strncmp(param_1, param_2, 0x1c);
10
  return;
11
}

1
(gdb) x/wx 0x601064
2
0x601064 <key>: 0x00000000

1
undefined8 main(int param_1,undefined8 *param_2) {
2
  if (param_1 == 2) {
3
    compare_pwd((char *)param_2[1]);
4
  }
5
  //...
6
}

1
void compare_pwd(char *param_1) {
2
  //...
3
  uVar1 = my_secure_test(param_1);
4
  if ((int)uVar1 == 0) {
5
    puts("password OK");
6
  }
7
  //...
8
}

1
undefined8 my_secure_test(char *param_1) {
2
  undefined8 uVar1;
3

4
  if ((*param_1 == '\0') || (*param_1 != '1')) {
5
    uVar1 = 0xffffffff;
6
  }
7
  else if ((param_1[1] == '\0') || (param_1[1] != '3')) {
8
    uVar1 = 0xffffffff;
9
  }
10
  //...
11
  else if ((param_1[7] == '\0') || (param_1[7] != 'd')) {
12
    uVar1 = 0xffffffff;
13
  }
14
  else if (param_1[8] == '\0') {
15
    uVar1 = 0;
16
  }
17
  else {
18
    uVar1 = 0xffffffff;
19
  }
20
  return uVar1;
21
}

1
undefined4 main(undefined param_1) {
2
    //...
3
    else if (local_14 == 0x7a69) {
4
        puts("Wow such h4x0r!");
5
        giveFlag();
6
    }
7
    //...
8
}

1
void giveFlag(void) {
2
  //...
3
  puVar2 = &DAT_080488e0;
4
  puVar3 = local_a8;
5
  for (iVar1 = 0x22; iVar1 != 0; iVar1 = iVar1 + -1) {
6
    *puVar3 = *puVar2;
7
    puVar2 = puVar2 + 1;
8
    puVar3 = puVar3 + 1;
9
  }
10
  memset(local_ca,0x41,0x22);
11
  for (local_20 = 0; local_20 < 0x22; local_20 = local_20 + 1) {
12
    local_ca[local_20] = (char)local_a8[local_20] + local_ca[local_20];
13
  }
14
  //...
15
}

1
(gdb) x/136xb 0x080488e0
2
0x80488e0:      0x25    0x00    0x00    0x00    0x2b    0x00    0x00    0x00
3
0x80488e8:      0x20    0x00    0x00    0x00    0x26    0x00    0x00    0x00
4
0x80488f0:      0x3a    0x00    0x00    0x00    0x2c    0x00    0x00    0x00
5
0x80488f8:      0x34    0x00    0x00    0x00    0x22    0x00    0x00    0x00
6
...

1
undefined4 main(int param_1,undefined4 *param_2) {
2
  //...
3
  if (param_1 == 2) {
4
    iVar2 = atoi((char *)param_2[1]);
5
    if (iVar2 == -0x35010ff3) {
6
      puts("Access granted.");
7
      giveFlag();
8
      uVar1 = 0;
9
    }
10
  }
11
  //...
12
}