Ben_Lolo's WeeperVM -- Level 1

Author:
Ben_Lolo

Language:
C/C++

Upload:
2025-04-12 01:11

Download

Platform:
Unix/linux etc.

Difficulty:
5.0

Quality:
5.5

Arch:
x86-64

Downloads:
35

Size:
13.78 KB

Writeups:
2

Comments:
3

Description

Delve into the world of virtualized code to recover a sacred phrase. This challenge provides a great opportunity to implement a custom processor for Ghidra or develop an architecture plugin for BinaryNinja. Various obstacles hinder static and dynamic analysis, but can be overcome using normal reversing techniques. Non-trivial protection algorithms are well-documented and conform to their respective specifications. * Encrypted strings * Anti-debug * Anti-breakpoint * Anti-thread suspension * Anti-patch * Virtualized code with loops, if/else, and janky functions

Comments (3)
Writeups (2)

You must be logged in to post a comment

Elvis on 2025-04-18 10:37: Nice WU. But did you miss include binary ninja arch plugin? Maybe you can upload another solution with binary ninja arch plugin. I would be glad to approve it and delete old solution

whitequark on 2025-04-18 12:06: The BN plugin is included, do `ln $(pwd)/bn ~/.binaryninja/plugins/weeper` and you should be able to open the .bndb. My bad, I should've added that to the writeup

Elvis on 2025-04-18 12:24: Got it. Thank whitequark

You must be logged in to submit a writeup

Solution by whitequark on 2025-04-18 08:15:
All collateral is in the archive, the explanation/log is in `writeup.md`. This was a fantastic crackme that required all of my skill and more; thanks! I particularly loved how my chosen solution of turning the scrambling function into hardware and then using hardware tooling worked very well where the symbolic RE tooling like angr did not. I would say that the BN architecture was a very easy part (it took me 3-4 hours at most to get there), and misreading `rax_2` as `rax` in the BN output cost me two days. As is the custom.

Download

Solution by sudhackar on 2025-04-23 04:59:
The zip has a writeup.md Very fun challenge - solved using pintool, frida, llvm-IR, python and eventually some cryptography. Failed with simple z3, klee etc. The binary itself is pretty simple - the vm code is insane to lift and identify. Looking to part2

Download

crackmes.one

crackmes.one

Ben_Lolo's WeeperVM -- Level 1