Tags: reverse_engineering ghidra
Rating:
Decompiling the main function in the givin file using ghidra and then cleaning it up gives
```c
int main(void)
{
size_t inputLength;
long in_FS_OFFSET;
int counter;
char input [104];
long canary;
canary = *(long *)(in_FS_OFFSET + 0x28);
setvbuf(stdin,(char *)0x0,2,0);
setvbuf(stdout,(char *)0x0,2,0);
puts("Welcome to SuperTexEdit!\n");
puts("To begin using SuperTexEdit, please enter your registration code.");
printf("Code: ");
__isoc99_scanf(&string_format_99s,input);
inputLength = strlen(input);
if (inputLength == 32) {
input[0] = input[0] + -0x69;
input[1] = input[1] + -0x71;
input[2] = input[2] + -0x67;
input[3] = input[3] + -0x70;
input[4] = input[4] + -0x5f;
input[5] = input[5] + -0x6f;
input[6] = input[6] + -0x60;
input[7] = input[7] + -0x74;
input[8] = input[8] + -0x65;
input[9] = input[9] + -0x60;
input[10] = input[10] + -0x59;
input[11] = input[11] + -0x67;
input[12] = input[12] + -99;
input[13] = input[13] + -0x66;
input[14] = input[14] + -0x61;
input[15] = input[15] + -0x57;
input[16] = input[16] + -100;
input[17] = input[17] + -0x4e;
input[18] = input[18] + -0x65;
input[19] = input[19] + -0x5c;
input[20] = input[20] + -0x5e;
input[21] = input[21] + -0x4f;
input[22] = input[22] + -0x49;
input[23] = input[23] + -0x4a;
input[24] = input[24] + -0x5c;
input[25] = input[25] + -0x46;
input[26] = input[26] + -0x4e;
input[27] = input[27] + -0x54;
input[28] = input[28] + -0x51;
input[29] = input[29] + -0x48;
input[30] = input[30] + -0x1c;
input[31] = input[31] + -0x5e;
counter = 0;
while( true ) {
if (31 < counter) {
puts("Key Valid!");
puts("SuperTexEdit booting up...");
/* WARNING: Subroutine does not return */
abort();
}
if (counter != input[counter]) break;
counter = counter + 1;
}
puts("Invalid code!");
}
else {
puts("Invalid code!");
}
if (canary != *(long *)(in_FS_OFFSET + 0x28)) {
/* WARNING: Subroutine does not return */
__stack_chk_fail();
}
return 1;
}
```
and from that we can see that the flag is 32 characters and can be constructed letter by letter.
for the exact flag, check the original write up
