# WriteupWe open the binary with IDA and we realize that the binary gets an input from stdin. Also the input password needs a 44 lenght value so we start with something like that `aaaaaaaaaaabbbbbbbbbbbcccccccccccddddddddddd`. We set a breakpoint here `0x0040341F` and patch this instruction with `jnz`.After the `fgets` function call we will analyze important functions.## sub_4018D9We are in this part of lenght `bbbbbbbbbbb` because of this instruction `movzx  eax, byte ptr [eax]` move 0x62 byte. Here `cmp dl, al` we realize that this compare with the first byte of hardcoded key `(mv|GLp+Gv+` xored, with our input byte xored two times so we need resolve this:```input[0] = ?xor1 = 0xbxor2 = 0x13al = 0x28```
The first input should be 0x30 or 0 if we want that this comparation is equal to `al` register. After all iteration we will have `0und_Th3_n3` so we have currently this --> `aaaaaaaaaaa0und_Th3_n3cccccccccccddddddddddd`
## sub_401AB9Next part we enter in this function and we realize that corresponds to the first part of the flag as it uses `aaaaaaaaaaa`. In this instruction `cmp bl, al` we see that this compare with the first byte of hardcoded key `}[2waHmrgxj` with our input 0x61 + two bytes, so this 0x63. Also with + four bytes after sixth iteration. We need resolve this:```0x63-0x2 = 0x61 (our input)0x7d-0x2 = 0x7b or { (correct input)```
We get `{Y0u_Finctf` and the correct will be `inctf{Y0u_F`. We have currently this --> `inctf{Y0u_F0und_Th3_n3cccccccccccddddddddddd`In `sub_4018A0` function we enter into and we realize that there is an **IsDebuggerPresent** so we just need patch the instruction with `jnz`.
## sub_401E73Next function we see that correspond with this part of lenght password `ddddddddddd`. In this code we need that `eax` register will be 0 after `strncmp` function call.```lea     eax, [ebp+var_2A]mov     [esp+48h+Str2], eax ; Str2lea     eax, [ebp+var_1F]mov     [esp+48h+Str1], eax ; Str1call    strncmpmov     [ebp+var_14], eax```
Str1 is hardcoded string {`I5z%u5dL~` and Str2 is our input 0x64 + one byte, so this 0x65.```0x65-0x1 = 0x64 (our input)0x7b-0x1 = 0x7a or z (correct input)```
The string will be `z_H4y$t4cK}`. We have currently this --> `inctf{Y0u_F0und_Th3_n3cccccccccccz_H4y$t4cK}`
## sub_4024C3In last function we see that our input starts from the end towards the beginning so we replace this part `ccccccccccc` with `ABCDEFGHIJK`. To resolve this problem we have a key `7D 15 41 1E 70 39 66 55 39 5D 6E` and other xored value:```First:0x4a+0x1 = 0x4b (our input)0x7d-0x1 = 0x7c or | (correct input)Second:xor = 0x4b^0x7d                               #0x4b = input and 0x7d second value of key.R= 0x15^0x7d = 0x68 or h (correct input)      #0x15 third value of key.Third:xor = 0x49^0x15                               #0x49 = input and 0x15 third value of key.R= 0x41^0x15 = 0x54 or T (correct input)      #0x41 third value of key.And so on...```
Finally we get this string value `3dl3_In_Th|` so the flag is: `inctf{Y0u_F0und_Th3_n33dl3_In_Th|z_H4y$t4cK}`by @naivenom**PKTeam**