# Entry language - (Reverse 100)
## Problem
You might be able to talk like them once you find who they are.
## Analysis & SolutionCredit: [@gellin](https://github.com/gellin)
```xpl0@kali:~/Desktop# file r100r100: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=0f464824cc8ee321ef9a80a799c70b1b6aec8168, stripped```Next we dropped it into IDA64 and found the two useful functions.Below is the password hashing and comparison function that takes in our input "password". Examining the comparison we see that it compares our input byte by byte, with a calculated hash value. It expects the result of the comparison to equal 1, so our input byte values will need to be 1 smaller than the actual key.
```signed __int64 sub_4007E8(){  signed __int64 result; // rax@3  __int64 v1; // rcx@6  char input; // [sp+0h] [bp-110h]@1  __int64 v3; // [sp+108h] [bp-8h]@1
  v3 = *MK_FP(__FS__, 40LL);  printf("Enter the password: ");  if ( fgets(&input, 255, stdin) )  {    if ( sub_4006FD(&input) )                   // right here it passes our input to the pass hash & compare function.    {      puts("Incorrect password!");      result = 1LL;    }    else    {      puts("Nice!");      result = 0LL;    }  }  else  {    result = 0LL;  }  v1 = *MK_FP(__FS__, 40LL) ^ v3;  return result;}
signed __int64 __fastcall sub_4006FD(__int64 input){  signed int i; // [sp+14h] [bp-24h]@1  char v3[8]; // [sp+18h] [bp-20h]@1  char v4[8]; // [sp+20h] [bp-18h]@1  char v5[8]; // [sp+28h] [bp-10h]@1  *(_QWORD *)v3 = "Dufhbmf";  *(_QWORD *)v4 = "pG`imos";  *(_QWORD *)v5 = "ewUglpt";  for ( i = 0; i <= 11; ++i )  {    if ( *(_BYTE *)(*(_QWORD *)&v3[8 * (i % 3)] + 2 * (i / 3)) - *(_BYTE *)(i + input) != 1 )      return 1LL;  }  return 0LL;}```
```//the meat*(_BYTE *)(*(_QWORD *)&v3[8 * (i % 3)] + 2 * (i / 3)) - *(_BYTE *)(i + input) != 1
.text:000000000040076E                 movzx   eax, byte ptr [rax].text:0000000000400771                 movsx   edx, al.text:0000000000400774                 mov     eax, [rbp+var_24].text:0000000000400777                 movsxd  rcx, eax.text:000000000040077A                 mov     rax, [rbp+var_38].text:000000000040077E                 add     rax, rcx.text:0000000000400781                 movzx   eax, byte ptr [rax].text:0000000000400784                 movsx   eax, al.text:0000000000400787                 sub     edx, eax.text:0000000000400789                 mov     eax, edx.text:000000000040078B                 cmp     eax, 1.text:000000000040078E                 jz      short loc_400797```
Time to open gdb to see if we can breakpoint at 0x400784 and see if we can steal the values we need out of the registers.
```xpl0@kali:~/Desktop# gdb ./r101 (gdb) startFunction "main" not defined.Make breakpoint pending on future shared library load? (y or [n]) y
Temporary breakpoint 1 (main) pending.Starting program: /home/xpl0/Desktop/r101 asdhello!<