Your first crackme: strings, ltrace, and Ghidra on a program you compile yourself

Build a practice target

Writing your own target guarantees it is safe and lets you check your understanding against the source afterwards. The program below compares input with a value assembled at runtime, which defeats a naive strings search and forces you to use a second technique.

Snippet

cat > crackme.c <<'EOF'
#include <stdio.h>
#include <string.h>
int main(void) {
    char want[16]; const char parts[][5] = {"blue", "lab-", "2026"};
    snprintf(want, sizeof want, "%s%s%s", parts[1], parts[0], parts[2]);
    char in[32];
    printf("key: "); if (!fgets(in, sizeof in, stdin)) return 1;
    in[strcspn(in, "\n")] = 0;
    if (strcmp(in, want) == 0) puts("flag{first_crackme}"); else puts("no");
    return 0;
}
EOF
gcc -O0 -o crackme crackme.c

Three techniques

strings shows the parts but not their order. ltrace intercepts library calls at runtime, so you see strcmp with both arguments, revealing the assembled key. Ghidra’s decompiler shows the logic in C-like form, which is the technique that scales to challenges where the comparison is custom code rather than strcmp.

Snippet

strings -n 4 crackme | grep -E 'blue|lab|2026|flag'
echo test | ltrace ./crackme 2>&1 | grep strcmp
# Ghidra: new project, import crackme, analyze, open main in the decompiler

Lab: harden and repeat

Change the program so it compares character by character after an XOR with a constant, recompile with -s to strip symbols, and repeat. strings and ltrace no longer help. In Ghidra, find main through the entry function, rename variables as you understand them, and reconstruct the key from the XOR loop. Check your answer by running the program.

Skills that carry over

Reading decompiled code, renaming variables, and following data flow from input to comparison are the core of reverse engineering. The Ghidra hub on this site covers navigation, the decompiler, and scripting in depth.

Diagram

Unstripped strcmp versus stripped custom check

Pick the technique for the target.

strcmp, symbols present

strings. Shows the parts

ltrace. Shows the full comparison

Ghidra. Confirms the logic

XOR loop, stripped

strings. Nothing useful

ltrace. No library compare

Ghidra. Required: read the loop

Check yourself

1. Which tool shows strcmp arguments while a program runs?

2. A stripped binary compares input with a custom XOR loop. Which approach works best?

3. Why compile your own crackme for practice?