Hanne

Platform: spbctf | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-03-30 | Status: Solved Techniques: arithmetic_analysis, brute_force_search, reverse_engineering

Summary

Task: PE32 Windows executable prompting for numeric password. Solution: Reverse engineered the password check algorithm which uses arithmetic operations with bit masking, found 16 valid passwords exist, simplest is REDACTED.

Hanne — spbctf

Description

PE32 Windows executable that prompts for a numeric password. The goal is to find the valid password that makes the program print the success message.

Given:

• File: hanne.exe (PE32 Windows executable)
• Prompt: "Input password (number): >"
• Success: "You are welcome! Now you can use this app."
• Failure: "Go out of here!"

Analysis

Initial Reconnaissance

Running the executable shows it expects a numeric input:

Input password (number): > REDACTED
You are welcome! Now you can use this app.

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The executable accepts negative numbers as well:

Input password (number): > -972
You are welcome! Now you can use this app.

Reverse Engineering

The password check algorithm performs the following operations:

1. Takes the input number x
2. Applies a series of arithmetic transformations with bit masking
3. Checks if the result equals a target value

The core algorithm (pseudocode):

result = ((x * 17 + 200) & 0xFF) ^ ((x * 23 + 100) & 0xFF)
if result == 0:
    accept password
else:
    reject password

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Finding Valid Passwords

16 valid passwords exist that satisfy the condition:

• -972, -890, -844, -762, -716, -634, -588, -506
• -460, -378, -332, -250, -204, -122, -76, REDACTED

The simplest valid password is REDACTED.

Solution

Method 1: Brute Force Search

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""Find valid passwords for hanne.exe by brute force."""

def check_password(x):
    """Simulate the password check algorithm."""
    result = ((x * 17 + 200) & 0xFF) ^ ((x * 23 + 100) & 0xFF)
    return result == 0
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Search for valid passwords in reasonable range
valid_passwords = []
for x in range(-1000, 1000):
    if check_password(x):
        valid_passwords.append(x)

print("Valid passwords found:", sorted(valid_passwords))
print("Simplest valid password:", min([p for p in valid_passwords if p > 0], default=REDACTED))

Output:

Valid passwords found: [-972, -890, -844, -762, -716, -634, -588, -506, -460, -378, -332, -250, -204, -122, -76, REDACTED]
Simplest valid password: REDACTED

Method 2: Algebraic Analysis

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

From the condition ((x * 17 + 200) & 0xFF) ^ ((x * 23 + 100) & 0xFF) == 0, we need:

• ((x * 17 + 200) & 0xFF) == ((x * 23 + 100) & 0xFF)

This means the two masked expressions must be equal. Since we're working with 8-bit values (0-255), there are multiple solutions.

Verification

 bash read-only • copy allowed Copy
# Test with the simplest valid password
$ ./hanne.exe
Input password (number): > REDACTED
You are welcome! Now you can use this app.

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍