awaplay's OBSCURA - THE ENTROPY COIL Ver 1.0

Author:
awaplay

Language:
C/C++

Upload:
2026-02-26 14:05

Download

Platform:
Windows

Difficulty:
3.0

Quality:
4.0

Arch:
x86-64

Downloads:
40

Size:
273.50 KB

Writeups:
0

Comments:
7

Description

[NOTE : Because the success threshold is quite difficult and the version may have been accidentally passed during pre-release testing, this version might be too hard or nearly impossible to crack.] [NOTE : A new version will be published soon!Thank you !] Hello everyone, This is my first crackme. Goal : Get the success message. I've tested it on Windows 10 and it went well. Anyway , I am not really expert , so if something went wrong , pls comment and I 'll fix it asap :( pls also comment if you have some good advice or just wanna comment one. *What a bad name ive made for this crackme!* Compiled with MSVC

Comments (7)
Writeups (0)

You must be logged in to post a comment

msym on 2026-02-27 10:38: Is there an input signal that actually works? The success message is 'SYSTEM STABLE. FREQUENCY MATCHED.', right?

awaplay on 2026-02-27 12:22: @msym umm , actually yes.The program returns the "SYSTEM STABLE" msg on success.I actually designed 2 algorithm for handling diff input (you must know it).I solve it on my computer by firstly using debuuger , like CE to get the hash salt and then use a small bruteforce code to get the finally key.For somehow python cannot bruteforce and will return none or sth invalid , I guess that is because tiny diff of result of the sin() func. Thank you! If you have any further questions , feel free to ask!

awaplay on 2026-02-27 12:31: [Click to reveal]

msym on 2026-02-27 13:32: Hi @awaplay I did not reverse function 140002D50 using Python. I have your crackme in my debugger and used the value I have at 0x140041CA0, which is F8DAB42F. I saw that you used rdtsc and CheckRemoteDebuggerPresent and made sure to use the right values. If I'm not mistaken, your crackme does the following: (i) - the signal does not work if its length is < 8. (ii) - the sum of the characters is taken in function 140003150, and if it exceeds 0x100, [rsp+28] is set to 1, which forces [rsp+2C] to not be 0 or 2 i.e. function 140003320 will not be called. Assuming the characters in the signal is >= 0x21 (!), then the sum of characters must exceed 0x100. In this case function 140003480 will be called. (iii) - Function 140003480 takes each input character, apply SHL 0xD, xor it with F8DAB42F, and calls function 140003540, which stores the first 16 bytes at 0x140041CAC and apply ROR 4. (iv) - The bytes at 0x140041CAC are XORed in function 1400036c0 with hardcoded values [0x57, 0x12...], and if the count of resulting characters which fall within 0x20 and 0x7E inclusive is at least 10, the success message will be printed. But it doesn't seem possible to choose ASCII characters to get the count to be at least 10, which is what's confusing me. Or maybe I made a mistake somewhere?

awaplay on 2026-02-27 15:51: @msym I am glad you have answered most of the points correctly. for ur (i) ,doubtlessly right. for ur (ii) , no prob , in 1350 , due to most 8-digit ASCII char sum >= 0x100 , so 3480 will be called. for (iii) , you've got the algorithm correctly for (iv) , it's definitely correct. Some notes: Idk what debugger you are using.But I've noticed that getting a success_score of 10 is indeed quite hard due to the entropy distribution. - I ve ran some other tests and I find out that it may be nearly impossible to have a success , and I may have a lucky try as I test to solve it. I will fix it asap , reduce the success_score requiremet to a lower number or use a dynamic number based on length inputed in the next version 0.2. Thank you again sincerely for your suggestion. If you could explain the program logic or your research process in more detail, I can provide you with more information! Note: I tried use "plsletmesuccess" input ,and found the success_score could be at 7.

msym on 2026-02-27 15:59: I'm using x64dbg. Yeah I'm able to find input signals with a score of 7 using my Python script. 10 is only possible on my computer if you allow Unicode characters it seems.

msym on 2026-02-27 16:17: Idk if my code is totally correct but I have it here https://leetcode.com/playground/KBskU94v The hex are converted to decimal already. I am not a dev nor do I have lots of experience so please excuse my code :)

Show all spoilers

You must be logged in to submit a writeup

crackmes.one

crackmes.one

awaplay's OBSCURA - THE ENTROPY COIL Ver 1.0