DevPinoy.org
A Filipino Developers Community
   

Challenge: Save the Devil!

rated by 0 users
This post has 11 Replies | 1 Follower

Top 10 Contributor
Posts 547
Points 8,985
cvega Posted: 10-29-2008 8:24 PM

Crack: Find the Algorithm
Method: Enter the code
Target: Newbie
Difficulty: Moderate
Restriction: No patching and please do not redistribute!



To save the devil, you need to enter the code to unlock the devil's lifestream before you run out of time!

Hint: The code is 8 digit long composed of all numbers!


Solution: Post the code (spoiler for everyone else)

Chris Vega This posting is provided "AS IS" with no warranties, and confers no rights My Weblog|Visit MSDN Community
Top 10 Contributor
Posts 835
Points 10,775
Thanks thanks thanks! I already examined the code, this is gonna be a tough one! (at least for newbs like us)

Top 10 Contributor
Posts 835
Points 10,775
Hay! I found where the magic number is being computed, don't know what to do with it though. Hahahaha!

Top 10 Contributor
Posts 835
Points 10,775

Hmmm... these are my findings, I'm not yet finished though... Still a little confused on what is being compared to trigger the fail/success codes. :( Am I close to solving this? :D


mov ecx, 8 ; i'm sure it checks for 8 characters/numbers

jmp@ CheckZero

@CheckChar:

LODS BYTE PTR DS:[ESI] ; read chars left to right

push eax ; preserve value of eax

mov eax, edx ; copy to eax

pop eax ; above line useless? We are actually be computing the last value from stack, not edx

add al,18 ; this to this seems

sub al,0C ; useless because

add al,18 ; after the last line

sub al,24 ; the initial value = to the result

xor al,4E

mov edx, eax

sub edx,0E

STOS BYTE PTR ES:[EDI]

dec ecx

@CheckZero:

cmp ecx, 0 ; check counter

ja @CheckChar ; next character

LEA EAX,DWORD PTR DS:[404175]

MOV EDX,DWORD PTR DS:[EAX]

MOV ECX,DWORD PTR DS:[EAX+4]

LEA EAX,DWORD PTR DS:[40407D]

SUB EDX,DWORD PTR DS:[EAX]

SUB ECX,DWORD PTR DS:[EAX+4]

add edx, ecx

add edx, eax

or edx, edx

Top 10 Contributor
Posts 835
Points 10,775
This things giving me a headache. Rolvin, how's your solution doing? Have we found the same routine?

Top 25 Contributor
Posts 156
Points 2,450

I haven't started it yet...

Right now, I am too busy studying ASP.NET... it's a job requirement and have to pass a certification exam. Too tedious...

 

  • | Post Points: 20
Top 10 Contributor
Posts 835
Points 10,775
Ow wow! Good luck!!!

  • | Post Points: 5
Top 10 Contributor
Posts 835
Points 10,775

I think I found a crucial part of the code;


004012DF LEA EAX,DWORD PTR DS:[404175] ; eax contains the correct number

004012E5 MOV EDX,DWORD PTR DS:[EAX] ; the first 4 digits are copied to edx

004012E7 MOV ECX,DWORD PTR DS:[EAX+4] ; the last 4 digits to ecx

004012EA LEA EAX,DWORD PTR DS:[40407D] ; our number copied to eax

004012F0 SUB EDX,DWORD PTR DS:[EAX] ; first 4 correct and our number subtracted, result in edx

004012F2 SUB ECX,DWORD PTR DS:[EAX+4] ; last 4 digits of correct and our number subtracted, result in ecx

004012F5 ADD EDX,ECX ; add the result of edx and ecx

004012F7 OR EDX,EDX ; is it zero? (0 means we've got a boy!)

Then nothing happens if it is not zero...



IF THAT IS THE CASE, THEN THE CORRECT NUMBER IS...

Spoiler Alert!

98681104

Spoiler Alert!

We'll be waiting for your next challenge!!! More! More! More! Thanks!

Top 10 Contributor
Posts 547
Points 8,985

Nice!

This is a cue that somebody has to create a new challenge Big Smile

Chris Vega This posting is provided "AS IS" with no warranties, and confers no rights My Weblog|Visit MSDN Community
  • | Post Points: 20
Top 10 Contributor
Posts 835
Points 10,775

Thanks chris! I learned a lot of tricks from this challenge, more please! ;)

I'm working on one, but this will take a while. So, why not post yours to further delay mine? Hahaha!

Top 25 Contributor
Posts 156
Points 2,450

@Modchip - Spoiler!!! hahaha.

Anyways, I'll review modchip's answer and I'll ask some few questions if I have any. :-)

 

  • | Post Points: 20
Top 10 Contributor
Posts 835
Points 10,775
I published my solution. Thanks!

Page 1 of 1 (12 items) | RSS
Copyright DevPinoy 2005-2008