CrackMe 01 — MASM password check

source
CosmoSSS's Password(Very Easy)
platform
Windows
architecture
x86
bitness
32-bit
format
PE32
written in
MASM (hand-written assembly)
difficulty
very easy
tools
Ghidra
approach
static only, binary never executed
date
2026-07-26

First look at the binary

The binary is a 32-bit x86 PE. The .data section holds three strings.

Ghidra shows the .text section
Ghidra shows the .text section

Finding the check

The program has three strings in .data. At first I assumed all three were output messages. Nothing in the data itself says which is which. The role comes from the consumer. I checked which API receives each string. Two of them are pushed to MessageBoxA, so they are output text. The third one is pushed to lstrcmpA, so it is the value the input is compared against. The imports made this easy to locate: GetDlgItemTextA reads the input field, lstrcmpA compares strings.

CALL USER32.DLL::GetDlgItemTextA ; four parameters, the third is the destination buffer
--------------------------
LEA EAX,[EBP + 0xfffffefc]
PUSH EAX                         ; the same buffer, so it holds the user input
--------------------------
PUSH s_SuperPass_00403000        ; the input is compared against this string

Result

So s_SuperPass_00403000 holds the password.

SuperPass

Takeaway

This was my first practice in reverse engineering and my first time using Ghidra.

Additional info

I found another crackme with the same task. That one still had its symbols, so the variable holding the reference value was literally named pass and the password was visible immediately: simba123.

Here there were no names, so I had to figure out the roles from how the strings were used. There the names were already in the binary.

The other crackme: https://crackmes.one/crackme/6a160c2a2b3df128c1df5cc1

← all writeups

Written with the help of AI, based on my own analysis and notes.