deo's Find the decryption key | Custom packer,no virtualization #2

Author:
deo

Language:
C/C++

Upload:
2026-05-10 16:33

Download

Platform:
Windows

Difficulty:
3.3

Quality:
5.0

Arch:
x86-64

Downloads:
77

Size:
308.50 KB

Writeups:
2

Comments:
7

Description

Packer Test #2 ------------------------------------------------------------ You need to find the key to decrypt the flag. ---------------------------------------------------------- If you find the key, enter it and print the flag; entering the wrong key will result in a "wrong password" error. ------------------------------------------------------------ I request the key and a detailed description to improve the packer, thank you. ---------------------------------------------------------- Additionally, if you want to find the password, after entering any password, it is decrypted in memory for a few seconds and then wiped back. My goal here is to learn the weaknesses of the packer and improve it.

Comments (7)
Writeups (2)

You must be logged in to post a comment

Luainterpreter on 2026-05-13 00:02: one heck of a packer u got here bud. been hours now, determined to crack it.

Anonymchik on 2026-05-13 11:57: [Click to reveal]

liboxin on 2026-05-13 13:43: @deo I've dumped the file by using x64dbg, but it seems like the dumped file is not totally unpacked and it's very hard to find the logic of the decryption,is there any one solved this crackme, if someone solved, please share your solution and write-up,it's a very crazy crackme, and now I'm going to be crazy

deo on 2026-05-13 14:41: [Click to reveal]

DevVolodya on 2026-05-13 16:23: [Click to reveal]

SingleJingle11 on 2026-05-14 10:26: [Click to reveal]# deo packer test #2 findings Sample: - Archive: `C:\Users\Gebruiker\Downloads\6a00b3533fba64e45dceaa2d.zip` - Extracted PE: `agesa113377.exe` - SHA-256: `3906C49A30719DC4793D5A1B2C1AB49322BA59A1DC916CAD6FAB1FE930319B1B` - PE64, image base `0x140000000`, entry `0x140048000` Answer: - Key: `x9K!7zPq4mNvR2bL` - Flag printed by the program: `FLAG{p3Wq8RnZmK4vYxT7Bc2J}` Verification: ```text stdout: '=== elevenpack crackme ===\nEnter password: [+] FLAG{p3Wq8RnZmK4vYxT7Bc2J}\n' ``` Packer observations: - The on-disk PE has no normal import table and adds custom sections `.elpk`, `.elst`, `.eldat`. - Entry point is in RWX `.elst` at `0x140048000`. - The stub allocates an RWX private region with `VirtualAlloc(NULL, 0x5698, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)`. - Under x64dbg MCP, the allocation returned `0x7a0000`; that region contained unpacked code and generated syscall/API thunks. - After a dummy password, the original program strings are visible in memory for several seconds, including: - `=== elevenpack crackme ===` - `Enter password: ` - `[+] %.*s` - `[-] internal: flag sentinel mismatch` - `[-] wrong password` - This confirms the stated weakness: a wrong input is enough to expose decrypted validation material in memory before wiping. Validation logic: - Main logic is restored at `0x140001650`. - Input is read into a stack buffer, CR/LF is stripped, and the final key length must be `0x10`. - It builds a ChaCha20 block from exposed static material: - 32-byte key at `0x140018370`: `9f42b71e88c305772ae910d64b336ca1580fe2957144be29cd83166fb007d852` - 12-byte nonce at `0x140018390`: `112233445566778899aabbcc` - counter `0` - It initializes a 16-byte encrypted expected-key buffer: `ceda634e735f802aa9d511adf14f31dd` - It XORs the first 16 ChaCha20 keystream bytes: `ec0e92e25e08aa9647d565d639d0a9dc` - It then XORs a fixed 16-byte mask: `5aedba8d1a2d7acdda6d3a0d9aadfa4d` - Resulting required key: `x9K!7zPq4mNvR2bL` Weaknesses useful for hardening: - The unpacked code and strings are recoverable from memory immediately after any password attempt. - The real validation routine is restored in the original image layout and can be dumped page-by-page. - The key derivation constants and ChaCha20 key/nonce are static and visible after unpacking. - The password check is a direct 16-byte comparison against a derived constant, so once the transient decrypted image is captured, the correct input is recoverable without brute force. - RWX allocation and generated executable private pages make the unpacking boundary easy to identify dynamically.

lunadial on 2026-05-15 00:03: [Click to reveal]

Show all spoilers

You must be logged in to submit a writeup

Solution by BigLongs on 2026-05-12 23:56:

Download

Solution by DevVolodya on 2026-05-13 16:19:
Time spent - half an hour

Download

crackmes.one

crackmes.one

deo's Find the decryption key | Custom packer,no virtualization #2