# get-password

| Item       | Value                   |
| ---------- | ----------------------- |
| Category   | **Reverse Engineering** |
| Difficulty | **Easy**                |

#### Challenge Overview

The `check_pw` function copies an array of **20 pointers to constant strings** into a local buffer and validates the input password over **96 iterations**.

For each index `i`:

* The string is selected using `i % 20`
* The character index inside the string is `2 * (i / 10)`
* The validation condition is:

```cpp
table_char - input[i] == 1
```

This means the expected input character is always **one less** than the corresponding character stored in the table.

#### Exploitation (Reverse Script)

By inverting the comparison, the password can be reconstructed directly without brute force:

```cpp
input[i] = strings[i % 20][2 * (i / 10)] - 1
```

Only **even-indexed characters** from each string are used, advancing every 10 input bytes.\
The following solvers reproduces the exact memory access pattern of the original binary:

### C++

```cpp
#include <iostream>

int main() {
    const char *strings[20] = {
        "SfBsOxPvNMDyNAhRSgsG",
        "VjYOkGDgkkXgULZUkCeh",
        "OYgUClVWJQAvOtMfBSPg",
        "UgGADoBNyIpiGNyfyuet",
        "RoSgSYiwNwAcSgnPOsMB",
        "4sGvkBZfEqfHEgvkUeUL",
        "ullIdbFSSDZrKCSAJIUz",
        "FPVZxzrNHXShDeRb1GXd",
        "RNpVNeyZRVHTOwZuNdQq",
        "VALsFVveUNPuUoDWlpXu",
        "VyNbOyZjyGBwQUiUxeSe",
        "xO2rYv2pXL3UWoDvBTDQ",
        "qCOaRDOZicRnhDSacIgc",
        "bGUTstlyoElXoIVVghRO",
        "MmNRiDVggENtBjNHvw>g",
        "MC2BCa1DjAyglyzgwQ>v",
        "LeNdcAOGPROrjrOUSiWC",
        "YQEvXfUjbEERJDEjLZcS",
        "baCAeWZGrnROqkJKchEi",
        "oLDKgG6TxDzrQu6amIlZ"
    };

    for (int i = 0; i < 96; i++) {
        std::cout << char(strings[i % 20][2 * (i / 10)] - 1);
    }

    return 0;

```

### Python

```python
dst = [
    "SfBsOxPvNMDyNAhRSgsG",
    "VjYOkGDgkkXgULZUkCeh",
    "OYgUClVWJQAvOtMfBSPg",
    "UgGADoBNyIpiGNyfyuet",
    "RoSgSYiwNwAcSgnPOsMB",
    "4sGvkBZfEqfHEgvkUeUL",
    "ullIdbFSSDZrKCSAJIUz",
    "FPVZxzrNHXShDeRb1GXd",
    "RNpVNeyZRVHTOwZuNdQq",
    "VALsFVveUNPuUoDWlpXu",
    "VyNbOyZjyGBwQUiUxeSe",
    "xO2rYv2pXL3UWoDvBTDQ",
    "qCOaRDOZicRnhDSacIgc",
    "bGUTstlyoElXoIVVghRO",
    "MmNRiDVggENtBjNHvw>g",
    "MC2BCa1DjAyglyzgwQ>v",
    "LeNdcAOGPROrjrOUSiWC",
    "YQEvXfUjbEERJDEjLZcS",
    "baCAeWZGrnROqkJKchEi",
    "oLDKgG6TxDzrQu6amIlZ"
]

input = [None] * 96

for i in range(0, 96):
    input[i] = chr(ord(dst[i % 20][2 * int(i / 10)]) - 1)

print(''.join(input))
```

Then just decode the **Base64** string using [CyberChef](https://gchq.github.io/CyberChef/#recipe=From_Base64\('A-Za-z0-9%2B/%3D',true,false\)).

*made by k0d*
