Moonlight's Nebula

Author:
Moonlight

Language:
C/C++

Upload:
2026-03-10 14:26

Download

Platform:
Windows

Difficulty:
3.0

Quality:
4.5

Arch:
x86-64

Downloads:
118

Size:
968.00 KB

Writeups:
0

Comments:
2

Description

Your task is to reverse engineer the binary and recover the correct activation key Rules: - No brute force - The key must be generated using reverse engineering - The program contains multiple layers of validation - Strings encrypted - Anti-debug protection is present Expected key format: XXXX-XXXX-XXXX

Comments (2)
Writeups (0)

You must be logged in to post a comment

DonCris on 2026-03-11 17:17: Nice crackme. I solved it by locating the real validation routine after the anti-debug checks (IsDebuggerPresent / CheckRemoteDebuggerPresent). The strings were only XOR-obfuscated with 0x5A, so decrypting them quickly revealed the prompt and success/fail paths. From there, the key check was straightforward: exact length 14, dashes at positions 4 and 9, a per-character transform whose total must be 0x539, plus a few direct relations between characters. I just rewrote that logic in a small script and generated a valid key without brute force. KEY: ADBC-PLZR-6YZR

S3TYB_GNI3SREV3R on 2026-03-11 18:32: Through reverse engineering the binary, I discovered the following layers of validation: 1. Anti-Debugging Protection: The program calls IsDebuggerPresent and CheckRemoteDebuggerPresent. If a debugger is detected, it decrypts and prints "Debugger detected" and exits. 2. String Encryption: All critical strings, including prompts and success/error messages, are encrypted using a simple XOR cipher with the key 0x5a. 3. Activation Key Validation: * Length: The key must be exactly 14 characters long. * Format: The characters at indices 4 and 9 must be dashes (-), matching the format XXXX-XXXX-XXXX. * Arithmetic Constraints: * key[0] ^ key[5] == 0x11 (17) * key[2] + key[7] == 156 (0x9c) * 2 * ord(key[10]) == ord(key[1]) + 40 * Checksum Verification: A complex sum of all non-dash characters is calculated using a transformation function f(c, i) (which involves an 8-bit bitwise rotation and addition based on the character's index). The total sum must equal exactly 1337 (0x539). The generated key ZZCC-KTYG-A9SU

You must be logged in to submit a writeup

crackmes.one

crackmes.one

Moonlight's Nebula