victormeloasm's FROGMAN!

Author:
victormeloasm

Language:
C/C++

Upload:
2026-06-30 10:25

Download

Platform:
Unix/linux etc.

Difficulty:
6.0

Quality:
6.0

Arch:
x86-64

Downloads:
74

Size:
16.59 KB

Writeups:
0

Comments:
3

Description

FROGMAN is a Linux x86-64 crackme. Find a valid access key for any identifier. Patching the success path is not considered a valid solution. A valid solution should explain the verification logic or provide a working keygen.

Comments (3)
Writeups (0)

You must be logged in to post a comment

a764934018@outlook.com on 2026-07-02 04:15: [Click to reveal]# Identifier Generated Key Result # ABC BFB32F13478D55B5 ACCESS GRANTED # FROGMAN 0F5B77E7FFB13D75 ACCESS GRANTED # TEST123 A70F7D359DBF3555 ACCESS GRANTED # HELLO 098919055F5D3F37 ACCESS GRANTED # WORLD123 F303E1D1F5F76949 ACCESS GRANTED import struct import sys # ============================================================ # Embedded data from the FROGMAN binary # ============================================================ BYTECODE_TABLE_HEX = "02b157c3c99335881520823812fb1f6e358a2c1d92610a3ca1323893aa2b23a5eb0b6ae7b4c57fdb03d5534c6c84a0d788df820412670a74c9b3c5356aa8a0b35a9d9bd1a61aed9aa754d21b476522ec96344f9e216040ec6b2aded520c9c4f31fb8c88654095a37e2d219f012f98a827e6faebb7a39471c8991c113e880c4b66ed83cf595c6468ad0262bd39bff68e125fc97704b598520ca8c1e6fc9fc3059971f3b6aacbde37b5ce29661005adca40cb762ae6b7de55e110cc0a2d260df21f003770b3c8a84da246bbba6034ed26948f6b4adb481cd4c2c1add319a6b8275cb068844e12a26da9f0757abff5d6d294ef5eaad224ef6df5eed926ad6b014ac18331aa1056c024e770057de35cf8c40badb095fb307c2fe46bad6c07d153a3bd4654bb67027e3b5501c96703365bb9f9d0878b17bc1fe14e6f2a3a25da868f7a4b4bbf785990601a62a8d21967a0b5515bb311b9198a61b209881981acb3d65f02fdc01b9ae1e5050c9fa972177006fe87d44ca9422240f27a939402884764801e67de776ce2aa10e1de7ca9c6595a6582e84e254ba82a94fb4486a0235b3b02ea075b18cf69ec4ac5801076b190c596b075c00c89df5cb4a11e756d9f41d144bbc83716a77766938059919cf77c64e1210eb2519192eb575bb59842f6222f61d2b6bf13ec41fb7f2a601967cff71406af8872cfd6660395b129f3480f36ec4c54230099fe6b7cde1c7c2e38196f091a00921bbd661d1e9fbca2b2febfdfaa1cd8a315fb167ebbf71eb0bdd1a63a4ea5a00dfcb493070b8e8ee356048a318d7277bb6d40bc229b48cbb9c51bddcf05be51a57d8f1a08f608361252d8330cb7b904c2bfb4420c995b9509e1d54b66ed43336ff8cc6ca1a89e0a9ba60ab9b697dfbdb951dec3cf4b0c8877a22ada9d1180b081eff5c9604c3d498856fd3cddff58dd3a2c5e46421aea2c313266bf080211efa3170ec62cb764de7f6096a5ece7d261fe7c5558030255c21c88a8b2160831a383775b9366b2373fd85e2e93c5e467ee1e170f4ff199b9398efa4e787452f9edbbb1b0d53ea93c891d5f7d589bfb267b214c66424efc906f4c0f1cb3b42b94acde37807d12aa81237a4f84ae1ff9645d95bd8c79037594891453bc8b6e69b041b0502ebaf875b6ad848ec57bf8060b330ab17559b43dfe90561d73678e1eb81f965734da157fd0c1ca45b5d3b82387ed28d3662bd880cd457bcb8114166dd7337629e6c9e1d04db72c185ab530386288fe361389f9ebaff87d44b3bed8c376685d8eda1eabc39af35c233e35ce077dbdd8c74cb09c125438233acbc9d0dcaedc739a64ed9118941af19ea6fdee51759e80426cb46dabb19acbba81b5b5a59df6c0d7e5e0b2f6f40aab608a411d456bfc704db47409a515120daad2dd3e4a02f9afb6c8d46e944659ea1b183ac0190ffb76a69172e529691945f2ed485074698beff8f1a05c69f702c2e92f3347c67b762586790f7f8ce20f0dc24369482d15a084755a22f99e6c166ba0b621f5d3f53c183f0276fbbb1baf5654e63287da67e1acafa22067300d77c5eaef6da2db538530cd93c44b6db737a42f11d85353be4de63c229f54ce6d9ab06596262fcafafb9c0a3c2e694dfb002f7619d3cc9c3fd964ae10144037355259b604a2803c2a789d656c9dafb8d6abfb6f40e583481aa75e396be36eba257cf8d6c27abc401c69bd88900ede603c1d9e8fd9e7a76f27becbf3f83a7a6eea882c84a8f268f07a548eb067c03a0fca65a6c9610687d9fc932f091bd6021ad0636a6319978b036514cc8336c015bf8b09086e34ab85c73cbf730a2455a99fb9f799e631bfb78964ea052b9fe26e1256694bb16af1b56a296f061ebd79b1088584851877f10a50eee90563f365a51ace160e4a4364e5a888277584d513871a85ddc637e25bc16027929289a620f1f7dc11a0d45220be31cb30eef3e16fefaccb171ad104ec22ff16a63cc776a1eb77f35fbf901cfce933a438ae02ff50e2c591a008bc8ccb2045c8e93e11dfbfa973fb7fe7a098afb9ed3edf4b5c953e2a4b7e2bda2e4c577e2f420ad8bb4cdfb56803391dee384bf5a898b6d96713e5e583fb0574ca0db69f442372a5a60c7b061032fb5bdb1e205572d293a43e1af2600bc44e931d6de7a11ec48f8493d3624d1d0c470ff6ba5f90c9351379ebbed263adcf424b823a1cc08db3508fca4245c69764935a83b9d5a78a3ff6c6008be73247f3308e9b4095535b6ed980543c1690f3e1de0aa9e86be78600a492260599ff9e7f7686a1a2118d0fe5bda39975582062d6041c64fab410aa3065fc777bd1e899a975a90657225f9cfdfb88d696de3956bc285228b4fdf1914b84fc39b339f093165fa51fde503362ed7e2385f01475b8054206f20b0ba04639d3e8b648952c5f64177195502d954773c1ac6a2a4f7e6619bfa13565bdb79eb0d4fc075e8ee9c6acdc40a587fbeb203291d5cc2de1e03611111582681043cfca9f46d93d114c9e6b6f7465d1fb0cddb6059a56ec6a2c9c59c6d45492e811f1a19a4ddd613f0e07b1738db6524273c83ad08c67e2575d395e26c59b5ed7869586e6b079df7f9f9dfeaac19c654d12529bdf29b64c02e36ae655f650f8fe7ffc1dbf745b6305b95d1e02145360ed2ee41278fcf1e4fd18ae5e3cad28712bff369b6fb2acbeff6a8fd9eabd4a6a75eb52d3dad34dbcce6b852acab26f9ae9741086a42278400ae0b37976dfa4bcaa08107c9f4fd12eede9975c170246a2d7d81d813de715c529e8cd5a7e72b4f03e05f5e7ba28f24d47f9b4ffcc6a5ec07bd4e4d7ea194f26ad37c6c29b0179e3f30fcabd5ae9d0fa21768238b3f1187ddb16687939139fc65afbad96c703d41472381b4e244d987144d35e4b4280b3d37b356b2280a003ab2c958638aefd63a876bc5283de5020d08f8d26f923e30f1bcf65e151b96eeace594e7d5bd1510a19678b977a5f469df100a8cad68ebc0edb1cd27b3726f0e7c5fbf486849670d78d75c56850d52088ed43b85d6e1a6fd030657c41491cb03ac2f3c5efa9053a726631a85e8c3e0b6e8e2b70bd7f2cd3cb04ac694f55efde298920897e19d5ff9e9751cba08cc6c08b20d0a069c82237c33b8edbea2f16fe100841712bded1c2526e367ce3795f338ebb13ec2ffd9c0a1f7cca8807b492d8d232aca632103ecaef35ca8b46cc30d3e37a94370635896a8f4dbd0269d30696b5146d55772ad767e0c9e4f460737f1712d4973456c9290486b137e8bb2be4208820309711c4b7fcf0745565ee53ee86e15feda2b9893c1655b6bd0c5b3bced971953df71fac584214cc1088d122c5749174bfecddb5b5e30ce421fd08192356ad6dc66649686d3518a4f04719067f7bd2b7ca15875b1952fb301f6e73427fe9df4f771c5cba5888e4b9ea71468f4815302428fea8e17cfc92b1d8c500c08bc36cd0a39b62292e8100772f872668d5eae88c96eb3865b730251265f7462a8a1d5d0a41116d4d7ae96b8a0e97b58fd82b07e297247090e653edab8d036ac8f3d7be4ef50a05d47785d3571c6626e7f3f64cf63a03d537f131aa27a85f1ca3a1cbcaa6113e5349e946f6f6249265d39be5f1cc33022a94f2520ac9c7c10499fa43d9036cbc139eef999afb98c80c02af35601167106d724bb5a1b897c4b70c15ca3c1102229c483742c0b5f712e201e9b2413635b07e604be2c53d92d9385dc8ef173bdcf39e37670b8afa1e1fb0f8229f7a608562171ddfffe8fcbc9bd5e8ff1c02787a1a24ae5c1e05934c8abea5fac92ab855083feea91e729b0feaa97d91909a31a72ec38d3ae58e5aca3ea7e3f242850f856f633e1dcb821931106c341f9da9bc1e96a74675f040974b614d07b030c2a47fc2a806387b13fb20a0ee2e7b0ab6a0f7b1c8d29e10f9fdaa239753b385afc9ea3c8f260280725e786aefd284789fa935c4aa35264a155360943f69a8ca51b7f6871cba1e2632e03657ff3a0386b1c82e0eb365d3393f5ef5b351a6c15d2e34976bf975cd2d1c0763fcc0513cae888f62145a2bd1653d650f84d3a910bad6d5cf7eb1a7c7fbe9260fc7fc62402e463e030998b719dde4b6c7b598092b961e5e01930d9a64db92f4bdd4ebe1a8202b508a31c7832bb1a8ee1738b13a60c3653ddb98c811a9ef15c4d077f1fc586cb14be01918b9de0b3acf2f0edb2ab7fd4a4b606efd64870665b0b13444200a13a1701fab590e54c30e236085f93853c31deb5d7b836f508f2dd9d05efc6abe5d35fc04f872d5aa2bd339a6fbbdb020e1faec9d3a7b86e7b65d94c11c4b33e72a6a3dfd7acfcfd5322dd71aa4431310bc93b9a1e55b057072c5398079350b77b5f44c45cbd144719c9cb42a2d7205ea5727ecb281dea78587fdfb94f5bb3a4e069e67db7fd14043540a43a2183e36ae5ebb45c9c01acf38089c6707b355f010b0f5f7aa8d0558f422fe5af92bd1790dd3ff73f971d7c401107d9f6e261d82d3b1f0f85c022ecc18d11e6b3d90409a03728ab5810ce54adf2b4ecdb7a4672a03143a9e460e64fb23e01d681b5fed85effa71574dc1e531cc01d2e7d3976ac088d449f4976ec8796378cf0a061a4f650a76bd3c71b9182725087e06dbaaa87519a2314ee0beb1f3cb2611ee9ed72be5495b0b2ec30e5360acdfe0de9975cfbc6dfadc17c7ffa998736f06ebca4917f42853bcfbe0f25b1b595f0f2229822d6b43dc3f8ba90e944ff4518b4b5e25540d3b6b7b1e92c54be7ea60ba70a583f6bb735f5eb26f1201058e37a8dfbbf27e00d2cad671c588c18458e06616e062efe20c2a507d98084a1ba6f838903b1225a14bc367ae8a17de0a5fffb53b084fd937e6cb2e9bf607a120532f396c21f1d449b1cb1ebadc363f6697c6cdf8d4c4867dae28ad32b8dff593ad8f1e9b5be17c49b5ef7b5687b3746f31771899127ab08dbdf4934a2f62f6da9df38c0f757079041d49cfffcaac4417f7420d0b7d9293fbbd010b23fc2411ed0baebcb79c160bf157f71f03fef2915f48ff689ddd064a6c274336047ee2d40ff9c7deaa530dd83888a9c6d07d983d3c5b7ba7b64cbf155a1b61c1c90ec8e2be88aab4012e824f1f677ac29e30b6be10d67a2c3508f75e20e0a7532d68135834b46a2ce8aa12153a402d0f649d8d6ee4b2f163c69f89b4c6f1286365db4057da195883485c092336ca3c834b69fabe144ea8793168f19b05b9cc1dfae25900f08bccaca655aee13745ededfabf785b39bff4e4ed306c74b259fa8f431dc97fe40cbbe181798c14cad4bbdccf211bdf515a770a1858e287b3ef9767ef1cf5af5c84720ed7939cc449e0b1cdb2e9643ecc961cae9e5d7caf5096f935343b3dd5246674e084429a45b9ce2771a446cd92d790e34385e651360da0c8407d9c2a4f8bf4bcb44b490b399556c4e4cc9d5635760a3ce56613f91bc90a46fd90449c138470a82de4e37b1afce79af3ca71654ffa75693cf0f486aa22d050e00554ba452e8043c7a7d63ad7d06c0db77534bbdbf6b32c8931399f42ab29a596b6a586914f8945a6a552f00d8a709a4a5082294820b46429cbb619d10a21b5946448b753d03c2dc37c0ff469f87f29d2d4367025cf5761a97348d85be49f06f0978828490a658fa41d8cb17badd92482096802b44700fee242d7fb9ac2354b1c4d60ffe71a7f440db0ff0a14b59ce2b5292ba72d1ee89c1c2bce2e9ca5dd650da4f6ef163eb3e02c8a565b91a18c432be6728b2164b061ba1bd42302a7784f1d3d16082e368976757aa4d8489" JUMP_TABLE_HEX = "7f362000000000003b402000000000003b402000000000003b402000000000003b40200000000000113e2000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000a73f2000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000493e2000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000001d3f2000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000005f412000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000006c412000000000003b402000000000003b402000000000003b40200000000000773a2000000000003b402000000000003b4020000000000029422000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000813b2000000000003b402000000000003b402000000000003b402000000000003b40200000000000883e2000000000003b402000000000003b402000000000003b402000000000005a3c20000000000083392000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000c8402000000000003b402000000000003b402000000000003b402000000000003b40200000000000d5402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b4020000000000014432000000000003b402000000000003b402000000000003b402000000000003b402000000000003e422000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000005f382000000000003b402000000000003b402000000000003b402000000000003b40200000000000da3c2000000000003b402000000000003b402000000000003b402000000000003b402000000000009c432000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000fc382000000000003b40200000000000da3b2000000000003b402000000000003b40200000000000013b2000000000003b402000000000003b402000000000003b40200000000000b43f2000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000cd3920000000000030442000000000003b402000000000003b402000000000003b40200000000000b0432000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000b93b200000000000673d2000000000000e422000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000743d2000000000003b402000000000003b402000000000003b402000000000003b4020000000000021372000000000003b402000000000003b402000000000006a3a2000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b402000000000003b4020000000000071422000000000003b402000000000003b402000000000003b40200000000000b0442000000000003b402000000000003b402000000000003b402000000000003e382000000000004840200000000000204e2000000000003b402000000000003b402000000000003b402000000000003b402000000000003b40200000000000a137200000000000" # Constants SEED = 0xd4c3b2a1908f7e6d MULT1 = 0xbf58476d1ce4e5b9 MULT2 = 0x9e3779b97f4a7c15 # golden ratio MULT3 = 0x94d049bb133111eb MASK_XOR1 = 0xfebdb10eaa975fac MASK_XOR2 = 0x9cf52ac829e1dbc1 # Parse embedded data BC_TABLE = bytes.fromhex(BYTECODE_TABLE_HEX) JT_RAW = bytes.fromhex(JUMP_TABLE_HEX) JT = [struct.unpack('<Q', JT_RAW[i*8:i*8+8])[0] for i in range(236)] def u64(x): return x & 0xffffffffffffffff def u8(x): return x & 0xff def u16(x): return x & 0xffff def splitmix64(x): x = u64(x) x = u64((x ^ (x >> 30)) * MULT1) x = u64((x ^ (x >> 27)) * MULT3) return u64(x ^ (x >> 31)) def compute_initial_pc(seed): rcx = seed ^ MASK_XOR1 rdx = u64(rcx >> 30) ^ rcx rdx = u64(rdx * MULT1) rcx = u64(rdx >> 27) ^ rdx rcx = u64(rcx * MULT3) rdx = u64(rcx >> 31) ^ rcx ecx = rdx & 0xff rdx2 = seed ^ MASK_XOR2 rax = u64(rdx2 >> 30) ^ rdx2 rax = u64(rax * MULT1) rdx2 = u64(rax >> 27) ^ rax rdx2 = u64(rdx2 * MULT3) rax = u64(rdx2 >> 31) ^ rdx2 eax = ((rax & 0xffffffff) << 8) | ecx eax ^= 0x12ab return u16(eax) def get_bytecode(pc, struct_mem): """Compute the raw bytecode at a given PC.""" pc = u16(pc) if (pc & 0xf000) == 0xf000: seed = struct.unpack('<Q', bytes(struct_mem[0x80:0x88]))[0] r8 = u64((pc & 0xfff) * MULT2) ^ seed hash_val = splitmix64(r8) & 0xff bc_off = (pc * 0xb5d + 0x6a7) & 0xfff bc_byte = BC_TABLE[bc_off] val = ((pc >> 4) + pc * 0x3d) & 0xffffffff sil = u8(val + 0xa7) sil ^= bc_byte sil ^= hash_val return sil elif (pc & 0xffffff80) == 0x80: return struct_mem[pc & 0x7f] else: return u8((pc * 29) ^ (pc >> 7) ^ 0xa5) def resolve_operand(operand_byte, struct_mem, with_xor=True): """Resolve an operand byte to a value. with_xor=True: (byte*29)^0xa5 for deterministic, struct read for >=0x80 with_xor=False: byte*29 for deterministic, struct read for >=0x80 """ if operand_byte >= 0x80: return struct_mem[operand_byte & 0x7f] else: val = (operand_byte * 29) & 0xff if with_xor: val ^= 0xa5 return val class FROGMAN_VM: def __init__(self, identifier, key="0000000000000000"): ident = bytearray(identifier.upper().encode('ascii')[:16]) key_b = bytearray(key.upper().encode('ascii')[:16]) self.struct_mem = bytearray(136) self.struct_mem[0] = len(ident) for i in range(16): self.struct_mem[1 + i] = ident[i] if i < len(ident) else 0 self.struct_mem[17] = len(key_b) for i in range(16): self.struct_mem[18 + i] = key_b[i] if i < len(key_b) else 0 struct.pack_into('<Q', self.struct_mem, 128, SEED) self.pc = compute_initial_pc(SEED) self.A = 0x00 self.B = 0x00 self.C = 0x00 self.D = 0xfd self.flags = 0x24 self.error = 0 self.loop_counter = 0 self.halt = False self.success = False def run(self, max_iter=1000001): while not self.halt and self.loop_counter < max_iter: self.loop_counter += 1 old_pc = self.pc self.pc = u16(old_pc + 1) bc = get_bytecode(old_pc, self.struct_mem) idx = bc - 5 if idx < 0 or idx >= 236: self.error = 1 self._dispatch_check() continue handler = JT[idx] self._execute(handler, old_pc, bc) self._dispatch_check() return self.success def _dispatch_check(self): halt_flag = self.struct_mem[0x22] if halt_flag != 0: self.success = (halt_flag == 2) self.halt = True return if self.loop_counter > 0xf423e: self.halt = True return if self.error & 1: self.halt = True return def _get_operand_raw(self, old_pc): """Get the raw operand bytecode at old_pc+1.""" return get_bytecode(u16(old_pc + 1), self.struct_mem) def _execute(self, handler, old_pc, bc): sm = self.struct_mem operand_pc = u16(old_pc + 1) # DEFAULT/ERROR if handler == 0x20403b: self.error = 1 # SET_FLAG_BIT2 (1-byte) elif handler == 0x2040c8: self.flags |= 0x04 # CLR_FLAG_BIT3 (1-byte) elif handler == 0x203a6a: self.flags &= 0xf7 # CLR_CARRY (1-byte) elif handler == 0x203fa7: self.flags &= 0xfe # D = B (1-byte) elif handler == 0x20439c: self.D = self.B # SHL A (1-byte): A <<= 1, carry = old MSB elif handler == 0x203e11: old_a = self.A carry = (old_a >> 7) & 1 result = u8(old_a << 1) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.A = result self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # SHR/ROR A (1-byte): A = (A >> 1) | (carry << 7) elif handler == 0x203983: old_a = self.A carry_out = old_a & 1 new_carry_in = (self.flags & 1) << 7 result = (old_a >> 1) | new_carry_in zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.A = result self.flags = carry_out | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # INC C (1-byte): C++ elif handler == 0x203bb9: result = u8(self.C + 1) carry = 1 if result == 0 else 0 # carry if wrapped zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.C = result self.flags = (carry) | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # A = B (1-byte) [op 138]: MOV A, B elif handler == 0x20423e: self.A = self.B result = self.B zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # A = IMM (2-byte): A = raw operand byte (no resolution) elif handler == 0x203fb4: self.pc = u16(old_pc + 2) val = self._get_operand_raw(old_pc) self.A = val zero = 1 if val == 0 else 0 sign = 1 if (val & 0x80) else 0 self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # B = IMM (2-byte): B = raw bytecode, flags updated elif handler == 0x203bda: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) self.B = ob zero = 1 if ob == 0 else 0 sign = 1 if (ob & 0x80) else 0 self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # C = IMM (2-byte): C = raw bytecode, flags updated elif handler == 0x2038fc: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) self.C = ob zero = 1 if ob == 0 else 0 sign = 1 if (ob & 0x80) else 0 self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # LOAD A = resolved operand (2-byte) elif handler == 0x203b01: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) self.A = val zero = 1 if val == 0 else 0 sign = 1 if (val & 0x80) else 0 self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # LOAD A indirect = resolved(operand + B) (2-byte) elif handler == 0x2043b0: self.pc = u16(old_pc + 2) ob = u8(self._get_operand_raw(old_pc) + self.B) val = resolve_operand(ob, sm, with_xor=True) self.A = val zero = 1 if val == 0 else 0 sign = 1 if (val & 0x80) else 0 self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # STORE A to struct[operand & 0x7f] (2-byte) elif handler == 0x204314: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) if ob >= 0x80: sm[ob & 0x7f] = self.A # XOR A ^= resolved operand (2-byte) elif handler == 0x20416c: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) result = self.A ^ val zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.A = result self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # OR A |= resolved operand (2-byte) [op 5] elif handler == 0x20367f: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) result = self.A | val zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.A = result self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # ADC A += raw operand byte + carry (2-byte) [op 105] elif handler == 0x203c5a: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) carry = self.flags & 1 result = self.A + ob + carry new_carry = 1 if result >= 0x100 else 0 result = u8(result) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 overflow = (~(self.A ^ ob) & (self.A ^ result) & 0x80) >> 7 self.A = result self.flags = new_carry | (zero << 1) | (self.flags & 0x3c) | (overflow << 6) | (sign << 7) # ADC A += resolved operand (without ^0xa5) + carry (2-byte) [op 101] elif handler == 0x203e88: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=False) carry = self.flags & 1 result = self.A + val + carry new_carry = 1 if result >= 0x100 else 0 result = u8(result) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 overflow = (~(self.A ^ val) & (self.A ^ result) & 0x80) >> 7 self.A = result self.flags = new_carry | (zero << 1) | (self.flags & 0x3c) | (overflow << 6) | (sign << 7) # ADC A += resolved operand (with ^0xa5) + carry (2-byte) [op 202] elif handler == 0x20420e: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) carry = self.flags & 1 result = self.A + val + carry new_carry = 1 if result >= 0x100 else 0 result = u8(result) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 overflow = (~(self.A ^ val) & (self.A ^ result) & 0x80) >> 7 self.A = result self.flags = new_carry | (zero << 1) | (self.flags & 0x3c) | (overflow << 6) | (sign << 7) # CMP A vs RAW bytecode (2-byte) [op 201]: flags only, A unchanged elif handler == 0x203d67: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) result = u8(self.A - ob) carry = 1 if self.A >= ob else 0 zero = 1 if self.A == ob else 0 sign = 1 if (result & 0x80) else 0 self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # CMP B vs RAW bytecode (2-byte) [op 224] elif handler == 0x204271: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) result = u8(self.B - ob) carry = 1 if self.B >= ob else 0 zero = 1 if self.B == ob else 0 sign = 1 if (result & 0x80) else 0 self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # CMP/SUB A vs raw operand (2-byte) [op 73] elif handler == 0x203a77: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) result = u8(self.A - ob) carry = 1 if self.A >= ob else 0 zero = 1 if self.A == ob else 0 sign = 1 if (result & 0x80) else 0 self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # CMP B vs resolved operand (with ^0xa5) (2-byte) [op 228]: flags only, A/B unchanged elif handler == 0x2044b0: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) result = u8(self.B - val) carry = 1 if self.B >= val else 0 zero = 1 if self.B == val else 0 sign = 1 if (result & 0x80) else 0 self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # CMP A vs resolved operand (without ^0xa5) (2-byte) [op 56] elif handler == 0x20415f: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=False) result = u8(self.A - val) carry = 1 if self.A >= val else 0 zero = 1 if self.A == val else 0 sign = 1 if (result & 0x80) else 0 self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # Conditional STORE (2-byte) [op 149]: if (bc[pc+1]+B) >= 0x80, struct[(bc[pc+1]+B)&0x7f] = A # No flag update elif handler == 0x203cda: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) ob_adj = u8(ob + self.B) if ob_adj >= 0x80: sm[ob_adj & 0x7f] = self.A # SUB A -= raw operand (2-byte) [op 41] elif handler == 0x203f1d: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) result = u8(self.A - ob) carry = 1 if self.A >= ob else 0 zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.A = result self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # JC: jump if carry (2-byte) elif handler == 0x2039cd: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) if self.flags & 0x01: offset = ob if ob < 0x80 else ob - 0x100 self.pc = u16(self.pc + offset) # JNC: jump if not carry (2-byte) elif handler == 0x20385f: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) if not (self.flags & 0x01): offset = ob if ob < 0x80 else ob - 0x100 self.pc = u16(self.pc + offset) # JZ: jump if zero (2-byte) elif handler == 0x2037a1: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) if self.flags & 0x02: offset = ob if ob < 0x80 else ob - 0x100 self.pc = u16(self.pc + offset) # JNZ: jump if not zero (2-byte) elif handler == 0x203d74: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) if not (self.flags & 0x02): offset = ob if ob < 0x80 else ob - 0x100 self.pc = u16(self.pc + offset) # JMP absolute (3-byte): PC = 16-bit operand elif handler == 0x204229: lo = get_bytecode(operand_pc, sm) hi = get_bytecode(u16(operand_pc + 1), sm) self.pc = u16((hi << 8) | lo) # ADC with complex addressing (3-byte) [op 125]: # PC += 3, operand_16 = (bc[pc+2]<<8)|bc[pc+1], addr = operand_16 + B # value = get_bytecode(addr), A = ADC(A, value) elif handler == 0x2040d5: lo = get_bytecode(operand_pc, sm) hi = get_bytecode(u16(operand_pc + 1), sm) self.pc = u16(old_pc + 3) addr = u16((hi << 8) | lo) + self.B val = get_bytecode(u16(addr), sm) carry = self.flags & 1 result = self.A + val + carry new_carry = 1 if result >= 0x100 else 0 result = u8(result) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 overflow = (~(self.A ^ val) & (self.A ^ result) & 0x80) >> 7 self.A = result self.flags = new_carry | (zero << 1) | (self.flags & 0x3c) | (overflow << 6) | (sign << 7) # CALL (3-byte): complex stack-based operation elif handler == 0x203e49: lo = get_bytecode(operand_pc, sm) hi = get_bytecode(u16(operand_pc + 1), sm) target = u16((hi << 8) | lo) # Push return address (current PC+3) to stack area # This is complex - need to verify self.pc = target # PUSH/stack operation (1-byte) [op 96] elif handler == 0x203b81: # Complex stack-based operation # D += 2, then store to struct[D], etc. pass # Need more analysis # INC B (1-byte): B++, preserve carry, update zero/sign elif handler == 0x20383e: result = u8(self.B + 1) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.B = result self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # INC C (1-byte): C++, preserve carry, update zero/sign elif handler == 0x203bb9: result = u8(self.C + 1) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.C = result self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # op 177 [op 177] elif handler == 0x204430: self.pc = u16(old_pc + 2) # Need more analysis - might be SUB or CMP variant ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) result = u8(self.A - val) carry = 1 if self.A >= val else 0 zero = 1 if self.A == val else 0 sign = 1 if (result & 0x80) else 0 self.flags = carry | (zero << 1) | (self.flags & 0x7c) | (sign << 7) # op 213 [op 213] elif handler == 0x203721: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) result = u8(self.A + val + (self.flags & 1)) new_carry = 1 if result >= 0x100 else 0 result = u8(result) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 overflow = (~(self.A ^ val) & (self.A ^ result) & 0x80) >> 7 self.A = result self.flags = new_carry | (zero << 1) | (self.flags & 0x3c) | (overflow << 6) | (sign << 7) # op 233 [op 233] elif handler == 0x204048: self.pc = u16(old_pc + 2) ob = self._get_operand_raw(old_pc) val = resolve_operand(ob, sm, with_xor=True) result = u8(self.A + val + (self.flags & 1)) new_carry = 1 if result >= 0x100 else 0 result = u8(result) zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 overflow = (~(self.A ^ val) & (self.A ^ result) & 0x80) >> 7 self.A = result self.flags = new_carry | (zero << 1) | (self.flags & 0x3c) | (overflow << 6) | (sign << 7) # op 138 [op 138] elif handler == 0x20423e: self.B = self.A result = self.A zero = 1 if result == 0 else 0 sign = 1 if (result & 0x80) else 0 self.flags = (self.flags & 0x7d) | (zero << 1) | (sign << 7) # DISPATCH (1-byte) [op 234] elif handler == 0x204e20: pass # op 160 (already handled above as LOAD C) # op 200 (already handled as INC C) else: self.error = 1 def generate_key(identifier): """Generate the access key for the given identifier.""" vm = FROGMAN_VM(identifier, "0000000000000000") vm.run() # The 8 expected bytes are at struct[0x40..0x47] expected = vm.struct_mem[0x40:0x48] return ''.join(f'{b:02X}' for b in expected) def main(): if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <identifier>") print(f"Example: {sys.argv[0]} ABC") print(f" {sys.argv[0]} FROGMAN") sys.exit(1) identifier = sys.argv[1] if len(identifier) < 3 or len(identifier) > 16: print(f"Error: identifier must be 3-16 characters, got {len(identifier)}") sys.exit(1) key = generate_key(identifier) print(f"IDENTIFIER: {identifier}") print(f"ACCESS KEY: {key}") if __name__ == '__main__': main()

a764934018@outlook.com on 2026-07-02 04:41: [Click to reveal]

victormeloasm on 2026-07-02 04:53: [Click to reveal]

Show all spoilers

You must be logged in to submit a writeup

crackmes.one

crackmes.one

victormeloasm's FROGMAN!