Reverse Engineering Password Checks

Finding a hidden password inside a binary is one of the most common reverse engineering challenges. It applies to malware analysis, crackmes, vulnerability research, and understanding proprietary protections.

Analysis Techniques

Strings analysis is always the first step:

c
Loading…

If the password is stored in plaintext, this reveals it immediately. Developers sometimes hide passwords as XOR-encrypted byte arrays to evade simple strings analysis.

Tracing comparisons in disassembly: look for strcmp, strncmp, or byte-by-byte comparison loops. Every password check has a success branch and a failure branch:

c
Loading…

For This Exercise

You will document how to find password-checking logic through strings analysis and comparison tracing. Tracing backward from a "wrong password" message to the comparison instruction reveals what input would satisfy the check.

Dynamic Analysis Fallback

When static analysis fails, run the binary under GDB with a breakpoint on strcmp using break strcmp and commands to print both arguments. The comparison reveals the expected password at runtime even if it was XOR-encrypted in the binary. Some crackmes compute passwords algorithmically, requiring you to reverse the generation logic rather than extract a static string.

Write a C program that checks a hardcoded password and documents how a reverse engineer would find it.

Requirements:

Implement a password check that compares input against a hardcoded string character by character
Document the strings analysis approach (running strings on the binary)
Document the comparison tracing approach (finding strcmp or byte loops)
Document how to locate the success path in assembly
Explain why client-side password checks are fundamentally reversible
Output must contain the keywords the test cases expect

Success Criteria:

Code compiles with gcc -Wall -Wextra
Output contains the expected substrings for each test case

Reverse Engineering Password Checks

Analysis Techniques

Strings analysis is always the first step:

c
Loading…

If the password is stored in plaintext, this reveals it immediately. Developers sometimes hide passwords as XOR-encrypted byte arrays to evade simple strings analysis.

Tracing comparisons in disassembly: look for strcmp, strncmp, or byte-by-byte comparison loops. Every password check has a success branch and a failure branch:

c
Loading…

For This Exercise

Dynamic Analysis Fallback

Write a C program that checks a hardcoded password and documents how a reverse engineer would find it.

Requirements:

Implement a password check that compares input against a hardcoded string character by character
Document the strings analysis approach (running strings on the binary)
Document the comparison tracing approach (finding strcmp or byte loops)
Document how to locate the success path in assembly
Explain why client-side password checks are fundamentally reversible
Output must contain the keywords the test cases expect

Success Criteria:

Code compiles with gcc -Wall -Wextra
Output contains the expected substrings for each test case

Reverse Engineer a Password-Checking Binary

Topic Overview

Reverse Engineering Password Checks

Analysis Techniques

For This Exercise

Dynamic Analysis Fallback

Implementation Task

Progressive Hints

Resources

Learn by building

Reverse Engineer a Password-Checking Binary

Topic Overview

Reverse Engineering Password Checks

Analysis Techniques

For This Exercise

Dynamic Analysis Fallback

Implementation Task

Progressive Hints

Resources

Learn by building