genass3's Continental

Author:
genass3

Language:
C/C++

Upload:
2026-02-08 22:02

Download

Platform:
Windows

Difficulty:
3.7

Quality:
3.3

Arch:
x86-64

Downloads:
54

Size:
94.00 KB

Writeups:
1

Comments:
3

Description

My first VM based crackme so feedback is very valuable, crackme contains: common anti-debug tricks, no string encryption, vm based hash generation, i was trying to do my best at self-modifying code, it also contains some mechanism that is gonna change correct password, and i specially left something inside to help solve that if you are stuck too much. I will accept correct password, or the complete explanation of how the crackme working, good luck! Feel free to ask about hints in comments.

Comments (3)
Writeups (1)

You must be logged in to post a comment

karabatik on 2026-02-09 16:50: [Click to reveal]so this is a pe64 binary compiled with mingw gcc 15.2 and right off the bat theres a solid anti-debug layer going on you got NtQueryInformationProcess checking both ProcessDebugPort and DebugObjectHandle then PEB.BeingDebugged and heap flags checks hardware breakpoint detection via GetThreadContext looking at Dr0 through Dr3 and a timing check using QueryPerformanceCounter all of these get stored as a bitmask in a TLS structure and xor encrypted with a key derived from GetTickCount xor GetCurrentProcessId theres also a background thread that continuously verifies a crc32 hash of the text section so if you try to patch anything at runtime it just kills the process with ExitProcess 0xDEADC0DE which is a nice touch now the main event is the custom vm its got 8 general purpose registers a 64 slot stack zero sign carry overflow flags and around 40 opcodes covering arithmetic logic shifts memory access conditional jumps push pop call ret even print and input instructions the hash algorithm itself runs as vm bytecode and for each password byte it does char xor 0xAA xor seed then left shifts by seed and 0x0F and stores only the low byte back then updates the seed with seed shl 1 xor 0x55 heres where the design issue comes in though since store byte only keeps the bottom 8 bits whenever the shift amount gets large you lose information completely for example at positions 2 and 3 the shift is 15 and 11 respectively so literally any character produces zero making the hash non-injective thousands of different passwords produce the same hash and even a single character D passes the check when a debugger is detected a random bit derived from a tls byte gets or'd into the seed which changes the correct password every session thats a clever mechanism but the information loss in the hash function means theres no unique password anyway overall for a first vm crackme this is really well done the anti-debug layering is solid the virtualprotect page noaccess trick for the vm memory is smart and the vm instruction set is surprisingly complete just watch out for the shift then truncate issue in the hash if you tighten that up so the hash is actually injective this would be a much stronger challenge example passwords: - D - Dirt_Rich - Dine_Rich

genass3 on 2026-02-09 21:14: [Click to reveal]

djd320 on 2026-02-10 06:22: dm me on discord if you want some help (@djd320)

Show all spoilers

You must be logged in to submit a writeup

Solution by djd320 on 2026-02-09 19:12:
the main weakness is the hash compression step caused by left shift then byte truncation. if uniqueness is desired, avoid lossy truncation in the core check path.

Download

crackmes.one

crackmes.one

genass3's Continental