s2.out

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: ascii_value_extraction, disassembly, hardcoded_byte_comparison, static_analysis

Summary

Walkthrough of the CUSTOM Reversing s2.out. A 32-bit ELF binary (also provided as PE32 for Windows). Simple password checker written in C. The goal is to find the correct password which serves as the flag.

Description

Download binary: s2.out. Flag is the correct password.

A 32-bit ELF binary (also provided as PE32 for Windows). Simple password checker written in C. The goal is to find the correct password which serves as the flag.

Analysis

1. File reconnaissance:

   • file s2.out shows it's a 32-bit ELF, not stripped
   • strings s2.out reveals:
     • "This is secure app, you need password to use it!"
     • "You are welcome! Now you can use this app."
     • "Go out of here!" ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Disassembly of main(): Using objdump -d s2.out, the main function logic is straightforward:

   • Prints prompt, reads input with scanf
   • Calls strlen and checks if length == 6 (cmpl $0x6)
   • Compares each character against hardcoded ASCII values

Solution

The disassembly shows direct character-by-character comparison:

 asm read-only • copy allowed Copy
cmpb $0x71, ...   # char[0] = 'q' (0x71)
cmpb $0x77, ...   # char[1] = 'w' (0x77)
cmpb $0x65, ...   # char[2] = 'e' (0x65)
cmpb $0x72, ...   # char[3] = 'r' (0x72)
cmpb $0x74, ...   # char[4] = 't' (0x74)
cmpb $0x79, ...   # char[5] = 'y' (0x79)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Converting ASCII values: 0x71='q', 0x77='w', 0x65='e', 0x72='r', 0x74='t', 0x79='y'

Password: REDACTED ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering ascii_value_extraction, disassembly, hardcoded_byte_comparison, static_analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • s2.out • Difficulty: Easy