Author:
eustome

Language:
C/C++

Upload:
2:25 AM 09/29/2025

Platform
Windows

Difficulty:
4.5

Quality:
4.0

Arch:
x86-64

Description

I am writing my anti-debug framework. This crack has a weakened version of it, and its purpose is to protect code from hooks, debugging attempts, patches, etc. What's interesting is that it doesn't use trivial PEB checks, etc., which are very easy to patch, but focuses on traps and consequences that the debugger creates in the program in one way or another. Statistical patches are not welcome; there is no virtualization or any other protection on crackme. It would be interesting to hear your opinion, since the framework itself is not very flexible and needs to be customized for each application, but I created a configuration system for this purpose.

• Comments
• Writeups

You must be logged in to post a comment

trendcrusher on 9:56 AM 09/30/2025: Hmm, it took 20 minutes... - h3110f413nD_9L@9Jl!s*jG IT allocates an execute-enabled stub at runtime (0x140004dcc) and decrypts 0x17 bytes from .rdata (0x1400100b0) using a byte wise XOR derived from the constants 0xDEADBEEFCAFEBABE and 0x1337BABE12345678. The resulting buffer is compared via the imported memcmp thunk (0x140009280) against the user-supplied wide string, so the decrypted ASCII text is the exact key accepted by the program Thank you for your work

nightxyz on 5:09 PM 09/30/2025: Without using any debugger, i executed program at cmd prompt and it says "Enter key: [Guard] DETECT: INT3 found in RX[Guard] DETECT: INT3 in RX". I am using Windows 10 x64 22H2.

You must be logged in to submit a writeup