Fatmike's Fatmike's Crackme #4

Author:
Fatmike

Language:
C/C++

Upload:
2023-06-04 21:01

Download

Platform:
Windows

Difficulty:
4.2

Quality:
6.0

Arch:
x86

Downloads:
20

Size:
422.23 KB

Writeups:
1

Comments:
7

Description

..::[FaTmiKE 2o23]::.. After a little break i decided to program another little crackme (This is my 4th crackme). Here are the rules: 1. The main goal is to unpack this crackme or write a loader. 2. If you like, find a valid serial or write a keygen. The crackme was tested on windows 10. Have fun!

Comments (7)
Writeups (1)

You must be logged in to post a comment

Ben_Lolo on 2023-06-09 02:41: I love to see a crackme that's as polished as this. MINOR SPOILERS: I'm taking this slowly as a learning experience on how to handle more difficult crackmes. I've followed the control flow up to the function at 0x404C00 and I have a feeling I know where it's going with the debugging and unpacking. If I'm correct and it's not a red herring, then it's a very interesting technique that I've not considered before now. Also challenging!

MARI0x83 on 2023-06-11 12:07: [Click to reveal]

Fatmike on 2023-06-11 15:24: I know, but what can i do? It's because protections often use similiar techniques as malware do. You can either trust me, or use a vm to debug the crackme-

Ben_Lolo on 2023-06-23 00:48: I feel like I'm so close to writing a keygen. All that's left now is some nitty-gritty reverse engineering to figure out how the name/serial pair is checked. I've been able to "unpack" it in the sense that I can debug the code after it's been unpacked and that I can extract the memory that contains the unpacked code. I think that's as far as I'll take the unpacking, since the method used seems like a royal pain to write an unpacker or loader for. MAJOR SPOILERS: So far I've found these things: - The name must be 4-8 alphanumeric characters. - The serial is 8 hexadecimal characters. - The conditional jump at +0x12F2 in the unpacked section is what chooses the "good" or "bad" sound. Now I need to figure out how the calls at +0x1B5B and +0x1B69 determine the input as correct. I've found calls to memcpy and memcmp that seem interesting, but we'll see.

timotei_ on 2023-06-28 19:07: [Click to reveal]

Fatmike on 2024-10-30 16:07: @Everyone : Thank you for your comments and feedback :) @Yanderome : Thanks for your solution, it was fun reading it!

jeffli6789 on 2026-01-04 06:25: This crackme had been reviewed when it was originally approved and is likely safe. Crackmes often get flagged by antivirus software, EDR systems, or VirusTotal because they may use the same protection techniques found in malware (packers, anti-debugging, self-modifying code, etc.), or simply a false positive. This does NOT mean the crackme is actually malicious. The only way to confirm whether something is truly malware is to reverse engineer it and find proof of malicious code and/or malicious behavior. If you still believe this is actual malware, please report it to us via email: crackmesone@gmail.com. **We encourage everyone to run crackmes in a VM (virtual machine) and exercise caution when executing unknown binaries.** *Disclaimer: We do our best to review submissions, but mistakes can happen. The administrators and crackmes.one cannot be held liable for any damages or losses resulting from the use of files downloaded from this site. Always exercise caution and use a sandboxed environment.*

Show all spoilers

You must be logged in to submit a writeup

Solution by Yanderome on 2023-07-01 20:13:
2023-07-01: Unpacked, keygenned, and everything in-between! This is a very nice and rewarding crackme! :)

Download