# 22.2.2 Level 0x01 - change a jump

Let's run the crackme:

     $ ./crackme0x01
     IOLI Crackme Level 0x01
     Password: foo
     Invalid Password!

As we can see, the goal is to patch the binary file to accept any password. We will proceed as in the previous level, first we open the file with radare, change the seek to sym.main and create a code graph:

     $ radare crackme0x01
     open ro crackme0x01
     Adding strings & symbol flags for crackme0x01
     14 symbols added.
     6 strings added.
     [0x08048330]> s sym.main
     [0x080483E4]> ag

TODO: http://radare.nopcode.org/img/wk/crackme0x01-sym.main.png

Let's take a closer look into the disassembly:

TODO: http://radare.nopcode.org/img/wk/crackme0x01_pD_sym.main.png

As you can see, it calls scanf() with "%d" so this time it expects an integer instead of a string, at offset 0x804842b it compares the value got by scanf with 0x149a and branches to password ok or password invalid depending on the result of this comparison.

Let's use radare to calculate the decimal value of 0x149a:

     [0x080483E4]> ? 0x149a
     0x149A ; 5274d ; 12232o ; 1001 1010
     [0x080483E4]>

We can see 0x149A in hex, and then the corresponding decimal, octal and binary values. So now we know the right password for this level is 5274 (in decimal).

Now let's patch the binary, we have to patch the conditional jump at offset 0x08048432, again we need to convert the opcode "jz" to "jmp" (goto). So we have to change the byte 0x74 to 0xeb.

Here we change the seek to the right offset, switch to write mode, patch the opcode byte, return the seek position to main and graph the patched code to see it follows the path we wanted:

     [0x080483E4]> s 0x08048432
     [0x08048432]> eval cfg.write = true
     warning: Opening file in read-write mode
     open rw crackme0x01
     [0x08048432]> wx eb
     [0x08048432]> s sym.main
     [0x080483E4]> ag

Here's the resulting graph:

TODO: http://radare.nopcode.org/img/wk/crackme0x01-sym.main_cracked.png

And finally try it:

     $ ./crackme0x01
     IOLI Crackme Level 0x01
     Password: foo
     Password OK :)

Done! :D