Tut's LSDtrip crackme!

Author:
Tut

Language:
C/C++

Upload:
2:54 PM 11/20/2024

Download

Platform
Windows

Difficulty:
2.5

Quality:
4.8

Arch:
x86

Description

The goal is to get the right password without patching. This way, you will ultimately prove that you are not tripping on LSD!

Comments
Writeups

You must be logged in to post a comment

nightxyz on 1:49 AM 11/21/2024: Password : 3p

nightxyz on 1:51 AM 11/21/2024: Password = 3p(smaller than sign)n Password is 4 characters long.

pechenka on 7:47 AM 11/22/2024: password: q'Hz

impsuhp on 5:00 PM 11/24/2024: also this is a good password: W#Vx

huh on 6:34 PM 11/24/2024: strip() so subtle and so elegant nice title

SirWardrake on 12:54 AM 11/26/2024: nice and easy Another pw: $viM

Abh0rrent on 7:07 PM 11/28/2024: Another PW: [YZY

Enhancer on 4:08 AM 11/29/2024: Hey im a little confused on this. I found where the password check is made, but the decimal sum is 945, but all the correct passwords in the comments add up to 895. How is this being changed? Its something altering local_C? Or am I completely off? this is what im going off of. if ((sVar1 == 5) && (local_c == 0x3b1)) { printf(s_[+]_Good_job!_You_sober!_00402054); }

nightxyz on 8:30 AM 11/29/2024: @Enhancer Password is 4 chars. Total is decimal 895. It also adds Line Feed character as a fifth char. So, 5 x 0ah = decimal 50. Now result is 945.

zerdotoh on 2:16 PM 11/29/2024: hey im new here can anyone explain how to solve these crackmes?

abobafoba on 4:04 PM 11/29/2024: In IDA PRO instruction "if ( strlen(Buffer) == 5 && v1 == 945 )" so then why do we actually need a password of length 4 with hash 895 not of length 5 and and hash 945?

Enhancer on 4:25 PM 11/29/2024: @nightxyz Thank you. I believe I understand a bit better now

mgnomov on 6:57 PM 11/29/2024: Another PW: LSCq

Atoilyy on 5:13 PM 11/30/2024: Another password: !!d|

killy on 12:40 AM 12/01/2024: Here's some REAL LSD https://github.com/kil-l-y/LSD I made this before you, so I own it. Have fun, it works really well and improves the system. If you want more, ping me.

Cappybara on 11:08 PM 12/01/2024: ~S!~ Solved with z3

mattpackman on 11:19 PM 12/02/2024: You dont need password. Here easy solution for noobs :) change 004010a3 JNZ LAB_004010cb to 004010a3 JMP LAB_004010b8

veru on 2:54 PM 12/04/2024: !!d|

nightxyz on 3:07 PM 12/04/2024: @Mattpackman Patch is not allowed otherwise specified.

iAniket9 on 6:14 PM 12/04/2024: Another Password : }x^

iAniket9 on 6:15 PM 12/04/2024: }x^(Greater than sign)

loksuu on 5:19 PM 12/06/2024: I'm ded! 💕

lil on 1:18 AM 12/09/2024: Another pass: 11dp. Tip: be carefull with the \n that fgets introduces...

Fopi1 on 8:10 AM 12/10/2024: Here's another password: __ZU

fuzzybear on 7:10 PM 12/19/2024: ddiF as well :) fun one. Very frustrating at first with /n char, helps build character :))

bernas198YT on 10:34 PM 01/07/2025: here my keygen for this crackme: https://pastebin.com/YRPLfEKq

hawktuagh243432 on 5:20 AM 01/23/2025: pretty cool

NayJi7 on 9:55 PM 02/04/2025: Another pass is s

triepixx_ on 8:01 PM 02/13/2025: why do yall keep commenting passwords damn i lose the game this way

You must be logged in to submit a writeup

Solution by huh:
# LSDtrip Crackme - Solution The password algorithm is as follows: ```c void __noreturn sub_401000() { int i; // [esp+0h] [ebp-Ch] int v1; // [esp+4h] [ebp-8h] char *Buffer; // [esp+8h] [ebp-4h] printf("\n \"LSDtrip\"\" crackme by Alon Alush, alonalush5@gmail.com \n\n PASSWORD "); Buffer = (char *)malloc(0x14u); fgets(Buffer, 20, (FILE *)iob[0]._ptr); v1 = 0; for ( i = 0; Buffer[i]; ++i ) v1 += (i + 1) * Buffer[i]; if ( strlen(Buffer) == 5 && v1 == 945 ) printf("\n [+] Good job! You sober! \n"); else printf("\nWrong! I think you're on LSD?"); getch(); exit(0); } ``` ## The catch: It's important to consider the line feed (0x0a) (\n) (10). The last character is fixed -- \n. So you need to solve for the first four: `a*1 + b*2 + c*3 + d*4 + 10*5 = 945` ## Z3 Using z3 in python: ```python from z3 import * solver = Solver() buffer = [Int(f'buffer_{i}') for i in range(5)] for i, b in enumerate(buffer): if i == 4: solver.add(b == 0x0a) continue solver.add(b = 65, b

Download

Solution by mist64:
One solution: msHU

Download

Solution by kasper3000:

Download

Solution by aname:
reverse logic and write bruteforce python script using itertools

Download

Solution by Benbaby:
Explain & keygen.

Download

Solution by NayJi7:
Firstly i made a patch, then i found a first solution in the .c that i provided and lastly i made a keygen using python. I pasted the keygen right below, it's really short. The password has to be 4 char long and it has to respect an equation. Password = "abcd" with the ascii int values of your chars such as a*1 + b*2 + c*3 + d*4 + 50 = 945. why 50? because the exe uses fgets and it has a \n read when you hit enter and \n is 10. You * by 5 and voila, 50. My keygen uses random to generate a pass with printable characters (31 to 127 in the ascii table). Thanks for the crackme ! It was my first it's so entertaining ! import random while True: i = random.randint(31, 127) j = random.randint(31, 127) k = random.randint(31, 127) l = random.randint(31, 127) print(f'{i} : {chr(i)}') print(f'{j} : {chr(j)}') print(f'{k} : {chr(k)}') print(f'{l} : {chr(l)}') print('-------------------') if i + 2*j + 3*k + 4*l + 10*5 == 945: print(f'A password is : "{chr(i)}{chr(j)}{chr(k)}{chr(l)}"') exit()

Download

crackmes.one

crackmes.one

Tut's LSDtrip crackme!