Reversing ELFs on TryHackMe: Crackme8

What it is

A walkthrough of TryHackMe's Crackme8, a 32-bit ELF. The author uses GDB with pwndbg to read main()'s disassembly and recover the two conditions gating the giveFlag function.

How it works

Initial recon (strings, plus GDB's info variables / info functions) surfaces the giveFlag symbol and "granted/denied" strings but no plaintext flag. The logic is in main(), disassembled via disass main after set disassembly-flavor intel. Two instructions matter:

• 0x080484ae cmp DWORD PTR [eax],0x2 — this checks the argument count, not an argument value. [eax] is argc; execution only falls through to the next gate when exactly one argument is supplied (argc == 2).
• 0x080484e4 cmp eax,0xcafef00d — after that argument is passed through atoi, the integer result must equal 0xcafef00d, i.e. decimal 3405705229.

Both comparisons must succeed to reach giveFlag.

flowchart TD
    A[crackme8] --> B{argc == 2?<br/>cmp [eax],0x2}
    B -- no --> X[Exit / prints denied]
    B -- yes --> C{atoi arg == 0xcafef00d?}
    C -- no --> X
    C -- yes --> F[giveFlag]

What to do

The page's payoff is that the displayed Usage: ./crackme8 password is misleading. The program wants a single numeric argument whose value is 0xcafef00d:

./crackme8 3405705229

(3405705229 is the decimal form of 0xcafef00d, the value compared at +73.)

Caveats

The fetched text is truncated mid-sentence in the "Counter-Intuitive inputs" section ("In order to do this from within GDB w…"), so the author's in-debugger method for supplying the argument and the final flag output are not captured here. The single-argument / argc==2 requirement and the target value are the actionable takeaways; the summary's phrasing ("argument value 2") conflates the first gate — it is an argument-count check, not a value of 2.