s1.out

Platform: rev-kids20.forkbomb.ru | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: little_endian_decoding, stack_string_reconstruction, static_disassembly

Summary

A 32-bit ELF binary (also provided as PE32 for Windows). Simple crackme compiled from C++ with GCC. The goal is to find the correct password which serves as the flag.

s1.out — Reverse Kids 2.0

Description

Download binary: s1.out (Linux) or s1.exe (Windows). Flag is the correct password.

A 32-bit ELF binary (also provided as PE32 for Windows). Simple crackme compiled from C++ with GCC. The goal is to find the correct password which serves as the flag.

Analysis

1. File reconnaissance:

   • file s1.out shows: ELF 32-bit LSB executable, Intel 80386, dynamically linked, not stripped
   • strings s1.out reveals:
     • "This is secure app, you need password to use it!"
     • "You are welcome! Now you can use this app."
     • "Go out of here!"
   • Uses strcmp for password comparison, scanf for input
   • Interesting partial strings visible: "VaL1", "DP@$", "$w0r" — fragments of the password ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Disassembly of main(): Using objdump -d s1.out, the password is constructed on the stack using 4 immediate mov instructions to avoid storing it as a single plaintext string:

 asm read-only • copy allowed Copy
movl $0x314c6156, -0x115(%ebp)   # "VaL1" (little-endian)
movl $0x24405044, -0x111(%ebp)   # "DP@$"
movl $0x72307724, -0x10d(%ebp)   # "$w0r"
movw $0x0044, -0x109(%ebp)       # "D\0" (null-terminated)

1. Program flow:
   • Prints prompt asking for password
   • Reads user input with scanf
   • Compares input against the stack-constructed password using strcmp
   • If match (strcmp returns 0): prints "You are welcome!"
   • If no match: prints "Go out of here!" ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

The password is split across multiple mov instructions that write to consecutive stack locations. Each 32-bit value is stored in little-endian format.

Reconstructing the password from hex values:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import struct

parts = [
    struct.pack('<I', 0x314c6156),  # VaL1
    struct.pack('<I', 0x24405044),  # DP@$
    struct.pack('<I', 0x72307724),  # $w0r
    struct.pack('<H', 0x0044),      # D\0
]
password = b''.join(parts).rstrip(b'\x00')
print(password.decode())  # REDACTED

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Verification:

 bash read-only • copy allowed Copy
$ ./s1.out
This is secure app, you need password to use it!
REDACTED
You are welcome! Now you can use this app.

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍