Lacks's Level 10

Author:
Lacks

Language:
C/C++

Upload:
2026-07-10 17:26

Download

Platform:
Windows

Difficulty:
3.5

Quality:
4.0

Arch:
x86-64

Downloads:
258

Size:
21.50 KB

Writeups:
1

Comments:
10

Description

This is level 10 the the 3nd last crackme im uploading

Labels ?

No labels yet.

Comments (10)
Writeups (1)

You must be logged in to post a comment

karity on 2026-07-10 23:52: [Click to reveal]

jackma on 2026-07-11 16:44: （hash = 0x3d17141a） key = 0x1a ^ 0xaa = 0xB0 [+] Correct! Decrypted flag: Perfect!

Lover1500 on 2026-07-13 23:22: [Click to reveal]

sillycat on 2026-07-15 07:02: [Click to reveal]

LvHatpruple on 2026-07-20 08:03: [Click to reveal]

kotsuge on 2026-07-21 21:43: ============================= CRACKME LEVEL 10 (BOSS) ============================= Enter Password: aNtidisEsTABLisHmenTarIAN [+] Correct! Decrypted flag: Perfect! Press Enter to exit... that was easy what is this 10 lvl...

Phantaso on 2026-07-22 07:24: password = !Srqt= FLAG{Th3_Thr34d_H4sh_M4st3r_2026}

sillycat on 2026-07-26 17:09: @kotsuge good job copying my answer LOL try something original next time

ludzof on 2026-07-28 23:24: The author pulled out all the stops for the final boss and used a classic anti-analysis technique: Multithreading. If you look at the main assembly dump, the password check isn't actually there! The main program uses the C++ std::thread library to spawn a background thread, waits for it to finish using _Thrd_join, and then checks a global variable at 7FF617BD6278 to see if the thread set it exactly to 0x3D17141A. If you step into the hidden thread function (1300), you'll find a loop containing this math: assembly imul ebx, ebx, 1F ; Multiply running hash by 31 add ebx, eax ; Add the current character This is the standard polynomial string hashing algorithm, better known as the exact formula used for String.hashCode() in Java! Because this is a 32-bit hash, there isn't just one correct password—there are millions of string collisions that mathematically satisfy the check. By writing a quick brute-force script, you can generate a valid collision. Entering the password tvhcfqdrp mathematically hashes to exactly 0x3D17141A and unlocks the program! The Flag: Unlike Levels 6, 8, and 9, the author finally got the flag encryption right on the boss level! The program takes the lowest byte of the target hash (0x1A) and XORs it with 0xAA to generate the decryption key 0xB0. If you decrypt the garbage string (+▲ ↔▲↑☼Z) with 0xB0, it reveals the true final flag: Perfect!

fourexp on 2026-07-30 23:49: how do you guys find the password? Usually I just edit the code in graph dissassembler and make every key correct

Show all spoilers

You must be logged in to submit a writeup

Solution by MoriartyPuth on 2026-07-14 18:20:

View

crackmes.one

crackmes.one

Lacks's Level 10