Solutions: The Hex Factor v2010 (C200)

You and your team are close to hacking a very complicated CBC encryption algorithm. The missing piece of the puzzle is finding a key which has a special property: a key which only has groups of 2 identical characters. For example, "00 bb 44 22 11 ff dd" is such a key, where "12 42 de ff aa cc 34" is not. You and your team are searching for the "first" secret key with this property, meaning the secret key with the lowest possible number of iterations.

Hint: you can solve this level by only changing 1 byte! Enter your answer using the format mentioned previously, so "00 bb 44 22 11 ff dd" (without the quotes) rather than "00:bb:44:22:11:ff:dd"

As is the case with a lot of reverse engineering challenges, this one is pretty easy to solve once you know what you are looking for.

Run the executable. The output shows a password after going through 15 iterations.

The password is cd b0 de 90 7f 79 8d dd, so not the format we are looking for...

Reverse engineering the password algorithm (used in every iteration) is one option, playing with the number of iterations is another one. The solution to this challenge is the second option (the iterations are using DES encryption).

Load the binary in OllyDbg. We are searching for the loop controlling the number of iterations that are used to calculate the password.

If we search for strings in the binary, we arrive at the following interesting section:

Seems like we arrived right in the loop code! Since we want to play with the total number of iterations, let's scroll down and look for the conditional check. We arrive at the following code section:

Click the image for a larger view

The line at 004013A0 is checking the loop counter against a fixed value 0F (15 in decimal). The for loop starts at 0 (check this in the code!) and goes up to 15, meaning there are 16 iterations in total. This is exactly the number of iterations being used in the original code!

Let's try to increase the number of iterations. Change the instruction at 004013A0 from

CMP DWORD PTR SS:[EBP-34],0F

to

CMP DWORD PTR SS:[EBP-34],10

This adds one extra iteration. Run the modified binary and you will see that an extra iteration is used during the calculation of the password! The resulting password however is not the password we are looking for. To get to the correct password, increase the counter by one and run the application again until a password with the correct format appears.

Since this is a cumbersome thing to do manually, the easiest way to solve this solution is by writing a small script (for example in perl or python) that automatically increments the counter, runs the application and checks if the resulting password has the format we are looking for. However nothing holds you back from doing this manually (although it might take 1 or 100000 steps to get to the solution ... You don't know in advance!).

The solution to the challenge is found when using 46 iterations, resulting in the following password:

ee 88 00 88 77 00 88 00

Challenge solved!

---

Feel free to e-mail questions and suggestions to daan.raman@thehexfactor.og.