Shabondy

Shabondy

Shabondy.exe

Please input the correct password : ...

Patching

Disassembling

• Use IDA Freeware, a disassembler software, to disassembly the program

  

• Inspecting the instructions graph...
  

  • a bit closer...
    
  • Look at the jnz (Jump Not Zero) instruction
    
  • Notice that conditional jump instruction link to this node address (loc_401AC7)...
    

Idea : Change the conditional jump (jnz) into unconditinal jump instruction (jmp) with the right address—the right node according to the above picture that will give the correct answer

• Patch the program
  • First, assign address name to the right node
  • Highlight the target instruction (jnz loc_401AC7)
  • Edit -> Patch Program -> Assemble...
  • Replace with the new instruction: jmp <right_address_name>
  • Edit -> Patch Program -> Apply patches to input file...
  • Run the patched program...

Result

Please input the correct password : .  // Input anything will do
You are on the right way: UEYM{RTXRY_EUXKIQY}
Key : 'KPMG'
Tip : 1.special characters and blank spaces are ignored.
      2.Please submit all flag with capital letters.

OK Google

Me : "What is ciphertext with key?"

Google : "Vigenere Cipher"

Decrypting...

Flag : KPMG{HELLO_PIRATES}

The True Password

Please input the correct password : KMGPas8M0rP{}$8@b0endW8yKPMR3f3R

Tip : Press F5 to decompile the assembly