> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/crackmes.one/1-difficulty-rating/untitled.md).

# Easy Keyg3nme

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYL7ok_7UlKBy4KbIe%2Fimage.png?alt=media\&token=895e225a-79fa-4128-b2da-e459356ff23b)

Lets download the zip file and unzip it. (Password: crackmes.one)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYLNQ5KoqoINUPLWXY%2Fimage.png?alt=media\&token=020a41ea-580e-4b5a-b45f-2322b2212474)

Lets run the file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYLeViNzJ5pywSJuN0%2Fimage.png?alt=media\&token=6d4a65ba-6f9d-4b19-94a1-6d8cbc02d7d7)

Its asks for a key, and it looks like if we type in the wrong key, its gives us a response saying `nope`.

Lets look at the file into more detail with the `strings` command

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYLvIhRWwxMr1CMF2n%2Fimage.png?alt=media\&token=e2168e41-712f-4bda-9c38-d180e8728f35)

Ok so it looks like we will get a message saying `Good job mate, now go keygen me` if we give it the right key. Lets open the file with `gdb` and look at the functions

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYMGzTNa1Or097cCrF%2Fimage.png?alt=media\&token=7aebcdb5-2647-4f72-9040-1af6cc4e2503)

Lets look at the main function by disassembling it

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYMUZa8hBfi-HRkiQG%2Fimage.png?alt=media\&token=7927ec33-3e3e-4aaa-9715-a18cfee0e2f8)

We are calling the `validate_key` function, lets check it out

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYMfUetWODNdTlNqWg%2Fimage.png?alt=media\&token=5d7aa05f-2eb9-4e09-8d3d-455c322ec188)

This line is the most interesting , we are using the `imul` instruction. Lets see what it does on google

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYN10nJkj-v6tbPMac%2Fimage.png?alt=media\&token=0b0dce41-67b3-4b96-8513-191a38d34e0e)

So it multiplies the integers, so in the screenshot above, we are multiplying `eax` with itself, and the value being `0x4c7` which is also `1223` in decimal

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYNSfzI83e0n8OHS4d%2Fimage.png?alt=media\&token=65b3702b-0630-4efd-8759-0dbd7dd0d8f9)

So lets try entering `1223` as the key or any multiple of 1223 as the key as we are multiplying it by itself and storing it in a variable that is the valid key.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MfYK2Oh5IlCR-Xgui0M%2F-MfYO8iQQitrUJVb_Nha%2Fimage.png?alt=media\&token=04273b8f-ec06-4364-8fb8-3caa29af69d8)

We have the answer