Problem

These days, I am busier with school and other “stuff” and saw this problem. It looked pretty easy, so I decided to give it a go. Let’s start by popping this thing into IDA.

.text:00000000004005DE                 lea     rdi, format     ; "Masukan PIN = "
.text:00000000004005E5                 mov     eax, 0
.text:00000000004005EA                 call    _printf
.text:00000000004005EF                 lea     rax, [rbp+var_4]
.text:00000000004005F3                 mov     rsi, rax
.text:00000000004005F6                 lea     rdi, aD         ; "%d"
.text:00000000004005FD                 mov     eax, 0
.text:0000000000400602                 call    ___isoc99_scanf
.text:0000000000400607                 mov     eax, [rbp+var_4]
.text:000000000040060A                 mov     edi, eax
.text:000000000040060C                 call    cek
.text:0000000000400611                 test    eax, eax
.text:0000000000400613                 jz      short loc_400623
.text:0000000000400615                 lea     rdi, s          ; "PIN benar ! \n"
.text:000000000040061C                 call    _puts
.text:0000000000400621                 jmp     short loc_40062F
.text:0000000000400623 ; ---------------------------------------------------------------------------
.text:0000000000400623
.text:0000000000400623 loc_400623:                             ; CODE XREF: main+3D↑j
.text:0000000000400623                 lea     rdi, aPinSalah  ; "PIN salah ! \n"

At address 0x400611, we check if the input is the correct pin by testing if eax is 0. So, we get to look in the function cek!

.text:00000000004005B6                 push    rbp
.text:00000000004005B7                 mov     rbp, rsp
.text:00000000004005BA                 mov     [rbp+var_4], edi
.text:00000000004005BD                 mov     eax, cs:valid
.text:00000000004005C3                 cmp     [rbp+var_4], eax
.text:00000000004005C6                 jnz     short loc_4005CF
.text:00000000004005C8                 mov     eax, 1
.text:00000000004005CD                 jmp     short loc_4005D4
.text:00000000004005CF ; ---------------------------------------------------------------------------
.text:00000000004005CF
.text:00000000004005CF loc_4005CF:                             ; CODE XREF: cek+10↑j
.text:00000000004005CF                 mov     eax, 0
.text:00000000004005D4
.text:00000000004005D4 loc_4005D4:                             ; CODE XREF: cek+17↑j
.text:00000000004005D4                 pop     rbp
.text:00000000004005D5                 retn

So from here, it looks like we to figure out if the content of the edi register is equal to the value in cs:valid. Hopping to that, we find

.data:0000000000601040 valid           dd 51615h               ; DATA XREF: cek+7↑r

0x51615 in base 10 (decimal) is 333333 which is the answer to our function.

Reversed code:

#include <stdio.h>

int FLAG = 0x51615; // 333333

int cek(int pin) {
    return pin == FLAG;
}

int main() {
    printf("Masukan PIN = ");
    int result = 0;
    scanf("%d", &result);
    if (cek(result)) {
        printf("PIN benar ! \n");
    } else {
        printf("PIN salah ! \n");
    }
}