Reverse Engineer a Password-Checking Binary

Topic Overview

Reverse Engineering Password Checks

Finding a hidden password inside a binary is one of the most common reverse engineering challenges. It applies to malware analysis, crackmes, vulnerability research, and understanding proprietary protections.

Analysis Techniques

Strings analysis is always the first step:

cCopy
Loading…

If the password is stored in plaintext, this reveals it immediately. Developers sometimes hide passwords as XOR-encrypted byte arrays to evade simple strings analysis.

Tracing comparisons in disassembly: look for strcmp, strncmp, or byte-by-byte comparison loops. Every password check has a success branch and a failure branch:

cCopy
Loading…

For This Exercise

You will document how to find password-checking logic through strings analysis and comparison tracing. Tracing backward from a "wrong password" message to the comparison instruction reveals what input would satisfy the check.

Dynamic Analysis Fallback

When static analysis fails, run the binary under GDB with a breakpoint on strcmp using break strcmp and commands to print both arguments. The comparison reveals the expected password at runtime even if it was XOR-encrypted in the binary. Some crackmes compute passwords algorithmically, requiring you to reverse the generation logic rather than extract a static string.

Your Task

Write the kind of program a reverse engineer practises on: it checks a password hard-coded in the binary, compared character by character. Alongside, print the analysis walkthrough explaining how an attacker recovers that password: strings analysis, tracing the comparison loop, finding and patching the success branch, and why client-side checks can never be secret.

Input

One line: the password guess (it may contain spaces). The secret is reverse engineer.

Output

1. Always print the four-part walkthrough first. Its exact text is shown in the example below: section headers === Step 1: Strings Analysis ===, === Step 2: Tracing Comparisons ===, === Step 3: Finding the Success Path === and === Why Client-Side Checks Are Reversible ===, separated by blank lines.
2. Then a blank line, and Password length: 16 characters (the secret's length).
3. Then correct password if the whole line (without its newline) equals the secret, else wrong password. A guess of the wrong length is rejected before any character is compared.

Example

Input:

cCopy
Loading…

Output:

cCopy
Loading…

Requirements

1. Compare lengths first, then characters one by one in a loop. That loop is exactly what the walkthrough teaches you to spot in the disassembly.
2. Read the guess with fgets and strip the trailing newline, so passwords with spaces work.

Hidden tests cover the correct password (with its space), another wrong guess (wrongguess), and a one-character guess (x).