nnxstnt's Juggler v2

Author:
nnxstnt

Language:
C/C++

Upload:
2024-09-20 22:17

Download

Platform:
Windows

Difficulty:
3.5

Quality:
4.5

Arch:
x86-64

Downloads:
16

Size:
335.50 KB

Writeups:
0

Comments:
6

Description

Second revision of my previous Juggler crackme, which had a cruel race condition, which I did not find during development at the time. Main challenge is circumventing the anti-debugging measures in place. Patching is allowed, but finding the key is the cooler option.

Comments (6)
Writeups (0)

You must be logged in to post a comment

nightxyz on 2024-10-12 10:13: [Click to reveal]

nnxstnt on 2024-10-12 19:51: hey, nice, would you mind posting a solution?

nightxyz on 2024-10-12 23:35: I used X64dbg , ScyllaHide Basic profile. First, i found the point where user key gets. After that, i traced step by step. I bypassed Int 4 trap. I "traced into" every "call juggler_v2.7FF72EDE9860" because "Trace over" failed. After loading all libraries, I continued to stepping. Somewhere in loop, I saw "curly bracket" next some register. The other register shows my entered key first character. I remembered the password structure for first revision of this crackme and I guessed that this crackme has same type password. I executed loop 32 times and write everey character to a paper. Finally it worked. I can't write solution but i solved with this way and a little bit luck :)

majorek31 on 2024-11-17 19:05: Thx, for sharing! waiting for solution approval, so pasting it here. very high quality crackme, but difficulty is a bit overrated. https://pastebin.com/p5wWVp01

nnxstnt on 2024-11-23 02:28: Hey, thanks for solving and your solution! Would be very nice if you could describe how you handled the anti-debugging measures, since they were the main challenge

majorek31 on 2024-12-30 22:32: Yeah sure, so after i found out that it's written in rust i didn't want to waste a lot of time in static analysis, so I run it in x64dbg, and after seeing the key prompt I set breakpoints on ret from VirtualAlloc( + EX), after getting each newly allocated blocks I set hw bp's on them just to find out that the one one 0x180000000 becomes MZ header for the decryptor :) if u have any more questions contact me on discord majorek1424 (638764515215015936)

Show all spoilers

You must be logged in to submit a writeup

crackmes.one

crackmes.one

nnxstnt's Juggler v2