$ r2 -d crackme1
[]> aaa
[]> afl
[]> pdf @main
// format is ***.*.*.*
// process
0x5606188a48de 48837db800 cmpq $0, var_48h
0x5606188a48de 48837db800 cmpq $0, var_48h
0x5606188a48eb 488d3de60000. leaq str.You_ve_got_the_correct_password, %rdi ; 0x5606188a49d8 ; "You've got the correct password"
// interesting
0x55959f52983c 488d057c0100. leaq 0x55959f5299bf, %rax ; "127"
0x55959f529843 488945c0 movq %rax, var_40h
0x55959f529847 488d05750100. leaq str.01., %rax ; 0x55959f5299c3 ; u"01.\\u7257\\u6e6f\\u2067\\u6150\\u7373\\u6f77\\u6472\\u5900\\u756f\\u7627\\u2065\\u6f67\\u2074\\u6874\\u2065\\u6f63\\u7272\\u6365\\u2074\\u6170\\u7373\\u6f77\\u6472\\u0100\\u031b\\u3c3b"
0x55959f52984e 488945c8 movq %rax, var_38h
0x55959f529852 488d056a0100. leaq str.01., %rax ; 0x55959f5299c3 ; u"01.\\u7257\\u6e6f\\u2067\\u6150\\u7373\\u6f77\\u6472\\u5900\\u756f\\u7627\\u2065\\u6f67\\u2074\\u6874\\u2065\\u6f63\\u7272\\u6365\\u2074\\u6170\\u7373\\u6f77\\u6472\\u0100\\u031b\\u3c3b"
0x55959f529859 488945d0 movq %rax, var_30h
0x55959f52985d 488d05610100. leaq 0x55959f5299c5, %rax ; u"1.\\u7257\\u6e6f\\u2067\\u6150\\u7373\\u6f77\\u6472\\u5900\\u756f\\u7627\\u2065\\u6f67\\u2074\\u6874\\u2065\\u6f63\\u7272\\u6365\\u2074\\u6170\\u7373\\u6f77\\u6472\\u0100\\u031b\\u3c3b"
0x55959f529864 488945d8 movq %rax, var_28h0x55959f52987b 488d35450100. leaq 0x55959f5299c7, %rsi ; "."
127.0.0.1...
$ r2 -d crackme2
[]> aaa
[]> afl
[]> pdf @main
// format is ********** {10}
// process
0x55bf031c1897 eb33 jmp 0x55bf031c18cc
0x55bf031c18cc 837dbc00 cmpl $0, var_44h
0x55bf031c18d0 7e17 jle 0x55bf031c18e9
0x55bf031c18e9 488d3d260100. leaq str.Correct_Password, %rdi ; 0x55bf031c1a16 ; "Correct Password"
[0x7feef4053090]> pdf @main
/ (fcn) main 283
| int main (int argc, char **argv, char **envp);
| ; var int32_t var_44h @ rbp-0x44
| ; var int32_t var_40h @ rbp-0x40
| ; var int32_t var_3ch @ rbp-0x3c
| ; var int32_t var_38h @ rbp-0x38
| ; var int32_t var_2eh @ rbp-0x2e
| ; var int32_t var_23h @ rbp-0x23
| ; var int32_t var_18h @ rbp-0x18
| ; DATA XREF from entry0 (0x55bf031c170d)
| 0x55bf031c17fa 55 pushq %rbp
| 0x55bf031c17fb 4889e5 movq %rsp, %rbp
| 0x55bf031c17fe 53 pushq %rbx
| 0x55bf031c17ff 4883ec48 subq $0x48, %rsp ; 'H'
| 0x55bf031c1803 64488b042528. movq %fs:0x28, %rax ; [0x28:8]=-1 ; '(' ; 40
| 0x55bf031c180c 488945e8 movq %rax, var_18h
| 0x55bf031c1810 31c0 xorl %eax, %eax
| 0x55bf031c1812 488d358f0100. leaq 0x55bf031c19a8, %rsi ; "r"
| 0x55bf031c1819 488d3d900100. leaq str.home_tryhackme_install_files_secret.txt, %rdi ; 0x55bf031c19b0 ; "/home/tryhackme/install-files/secret.txt"
| 0x55bf031c1820 e89bfeffff callq sym.imp.fopen ; file*fopen(const char *filename, const char *mode)
| 0x55bf031c1825 488945c8 movq %rax, var_38h
| 0x55bf031c1829 488b55c8 movq var_38h, %rdx
| 0x55bf031c182d 488d45d2 leaq var_2eh, %rax
| 0x55bf031c1831 4889d1 movq %rdx, %rcx
| 0x55bf031c1834 ba0b000000 movl $0xb, %edx ; 11
| 0x55bf031c1839 be01000000 movl $1, %esi
| 0x55bf031c183e 4889c7 movq %rax, %rdi
| 0x55bf031c1841 e84afeffff callq sym.imp.fread ; size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream)
| 0x55bf031c1846 8945c4 movl %eax, var_3ch
| 0x55bf031c1849 837dc400 cmpl $0, var_3ch
| ,=< 0x55bf031c184d 7916 jns 0x55bf031c1865
| | 0x55bf031c184f 488d3d830100. leaq str.Error_Reading_File, %rdi ; 0x55bf031c19d9 ; "Error Reading File"
| | 0x55bf031c1856 e825feffff callq sym.imp.puts ; int puts(const char *s)
| | 0x55bf031c185b b8ffffffff movl $0xffffffff, %eax ; -1
| ,==< 0x55bf031c1860 e995000000 jmp 0x55bf031c18fa
| |`-> 0x55bf031c1865 488d3d800100. leaq str.Please_enter_password, %rdi ; 0x55bf031c19ec ; "Please enter password"
| | 0x55bf031c186c e80ffeffff callq sym.imp.puts ; int puts(const char *s)
| | 0x55bf031c1871 488d45dd leaq var_23h, %rax
| | 0x55bf031c1875 4889c6 movq %rax, %rsi
| | 0x55bf031c1878 488d3d830100. leaq str.11s, %rdi ; 0x55bf031c1a02 ; "%11s"
| | 0x55bf031c187f b800000000 movl $0, %eax
| | 0x55bf031c1884 e847feffff callq sym.imp.__isoc99_scanf ; int scanf(const char *format)
| | 0x55bf031c1889 c745bc090000. movl $9, var_44h
| | 0x55bf031c1890 c745c0000000. movl $0, var_40h
| |,=< 0x55bf031c1897 eb33 jmp 0x55bf031c18cc
| .---> 0x55bf031c1899 8b45bc movl var_44h, %eax
| :|| 0x55bf031c189c 4898 cltq
| :|| 0x55bf031c189e 0fb65405d2 movzbl -0x2e(%rbp, %rax), %edx
| :|| 0x55bf031c18a3 8b45c0 movl var_40h, %eax
| :|| 0x55bf031c18a6 4898 cltq
| :|| 0x55bf031c18a8 0fb64405dd movzbl -0x23(%rbp, %rax), %eax
| :|| 0x55bf031c18ad 38c2 cmpb %al, %dl
| ,====< 0x55bf031c18af 7413 je 0x55bf031c18c4
| |:|| 0x55bf031c18b1 488d3d4f0100. leaq str.Wrong_Password, %rdi ; 0x55bf031c1a07 ; "Wrong Password"
| |:|| 0x55bf031c18b8 e8c3fdffff callq sym.imp.puts ; int puts(const char *s)
| |:|| 0x55bf031c18bd b8ffffffff movl $0xffffffff, %eax ; -1
| ,=====< 0x55bf031c18c2 eb36 jmp 0x55bf031c18fa
| |`----> 0x55bf031c18c4 836dbc01 subl $1, var_44h
| | :|| 0x55bf031c18c8 8345c001 addl $1, var_40h
| | :|| ; CODE XREF from main (0x55bf031c1897)
| | :|`-> 0x55bf031c18cc 837dbc00 cmpl $0, var_44h
| | :|,=< 0x55bf031c18d0 7e17 jle 0x55bf031c18e9
| | :|| 0x55bf031c18d2 8b45c0 movl var_40h, %eax
| | :|| 0x55bf031c18d5 4863d8 movslq %eax, %rbx
| | :|| 0x55bf031c18d8 488d45dd leaq var_23h, %rax
| | :|| 0x55bf031c18dc 4889c7 movq %rax, %rdi
| | :|| 0x55bf031c18df e8bcfdffff callq sym.imp.strlen ; size_t strlen(const char *s)
| | :|| 0x55bf031c18e4 4839c3 cmpq %rax, %rbx
| | `===< 0x55bf031c18e7 72b0 jb 0x55bf031c1899
| | |`-> 0x55bf031c18e9 488d3d260100. leaq str.Correct_Password, %rdi ; 0x55bf031c1a16 ; "Correct Password"
| | | 0x55bf031c18f0 e88bfdffff callq sym.imp.puts ; int puts(const char *s)
| | | 0x55bf031c18f5 b800000000 movl $0, %eax
| | | ; CODE XREFS from main (0x55bf031c1860, 0x55bf031c18c2)
| `--`--> 0x55bf031c18fa 488b4de8 movq var_18h, %rcx
| 0x55bf031c18fe 6448330c2528. xorq %fs:0x28, %rcx
| ,=< 0x55bf031c1907 7405 je 0x55bf031c190e
| | 0x55bf031c1909 e8a2fdffff callq sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
| `-> 0x55bf031c190e 4883c448 addq $0x48, %rsp ; 'H'
| 0x55bf031c1912 5b popq %rbx
| 0x55bf031c1913 5d popq %rbp
\\ 0x55bf031c1914 c3 retq
[0x7f34d5dc2090]> dr
rax = 0x00000000
rbx = 0x00000000
rcx = 0x00000000
rdx = 0x00000000
r8 = 0x00000000
r9 = 0x00000000
r10 = 0x00000000
r11 = 0x00000000
r12 = 0x00000000
r13 = 0x00000000
r14 = 0x00000000
r15 = 0x00000000
rsi = 0x00000000
rdi = 0x00000000
rsp = 0x7ffcf89780a0
rbp = 0x00000000
rip = 0x7f34d5dc2090
rflags = 0x00000200
orax = 0x0000003b
// from ssh
tryhackme@ip-10-10-150-26:~$ cat /home/tryhackme/install-files/secret.txt
vs3curepwd