Share how awesome the crackme was or where you struggle to finish it! Stay polite and do not spoil the solution/flag!
Please keep the comments section English-only.
Author:
sovereign
Language:
C/C++
Upload:
2026-06-02 19:44
Platform:
Windows
Difficulty:
6.0
Quality:
5.0
Arch:
x86-64
Downloads:
82
Size:
135.36 KB
Writeups:
0
Comments:
3
Description
hi, i've been working on this for a while. it's an upgraded version of ouroboros. compiled with msvc x64, no bulky packers. if you are a spoonfed skid who only knows how to load a binary in x64dbg and set a breakpoint on GetProcAddress or dynamic APIs, don't waste your time. inside the program: - a custom 64-bit modular elliptic curve arithmetic VM (ECC VM mod 2^64-59) running polymorphic bytecode. - non-linear MBA JIT validator that compiles verification paths on the fly. - rolling key sliding-window SMC shifter that keeps only one instruction decrypted in memory at any tick (Trap Flag based). - dual decoy/real verification flow. there is a decoy serial. if you enter it, it will say "DONE" and then drop a latent failure thread that cleanly crashes the process 30 seconds later. don't fall for the bait. - anti-emulation (windows-specific memory checks), anti-symbolic execution (FPU/Z3 traps), and rdtsc latency checks that silently mutate the curve parameters and real keys. - active guardian thread scanning memory sections, checking hardware/software breakpoints, and page guard minefields. [goal] 1. bypass the parent process checks (you gotta run it from explorer/cmd/powershell or VS, don't run it from suspicious loaders/debuggers). 2. find the real serial that triggers the actual injection-wipe of the target string from dummy_target.exe. 3. make sure you don't get trapped by the delayed crash. when you find the real serial, it will output the real success hash. 4. write a writeup explaining how you bypassed the trap flag shifter, the anti-emulation traps, and how you recovered the modular division math. glhf