DOSBox Debugger Dynamic Analysis for peace.com ================================================ METHOD 1: BREAKPOINT AT PASSWORD COMPARISON -------------------------------------------- 1. Download DOSBox with debugger from: http://www.vogons.org/viewtopic.php?t=7323 (Your regular DOSBox doesn't have debugging features) 2. Start DOSBox debugger and mount: mount c C:\Users\Roose\Downloads c: 3. Load program in debugger (DON'T RUN YET): debug peace.com 4. Set breakpoint at password comparison (from our analysis at 0xEC0): BP 1EC0 (Note: Add 0x100 offset for .com files, so 0xEC0 becomes 0x1EC0) 5. Run the program: F5 6. Navigate to option 4 (ADMIN LOGIN), enter any password 7. When it breaks at comparison, examine memory: D DS:SI (or wherever password is loaded) D ES:DI (or wherever input is stored) 8. The correct password should be visible in memory! METHOD 2: MEMORY DUMP DURING RUNTIME ------------------------------------- 1. Run peace.com normally in DOSBox debugger 2. Press Ctrl+F12 to break into debugger 3. Search memory for "PASSWORD>" prompt: SR 0 FFFF "PASSWORD" 4. Examine nearby memory for password storage 5. Continue and break again after entering test password METHOD 3: TRACE EXECUTION -------------------------- 1. Set breakpoint at success message location (0xC6E2 has "ACCESS GRANTED"): BP 1CE2 2. Enter various passwords, see what memory values cause success RUST IN PEACE THEMED PASSWORDS TO TRY: --------------------------------------- Based on Megadeth's album "Rust in Peace" (1990): - holy (Holy Wars...The Punishment Due) - wars - take (Take No Prisoners) - five (Five Magics) - dawn (Dawn Patrol) - rust - tornado (Tornado of Souls) - poison (Poison Was The Cure) - lucretia (My Friend of Misery) From static analysis: - kind (found at 0xC030) - nuke (nuclear/apocalyptic theme) - dave (Dave Mustaine) - vic (Vic Rattlehead mascot)