S90x123's hard crack me

Author:
S90x123

Language:
C/C++

Upload:
2026-07-26 18:23

Download

Platform:
Windows

Difficulty:
4.0

Quality:
2.7

Arch:
x86-64

Downloads:
931

Size:
939.50 KB

Writeups:
2

Comments:
9

Description

try to get the password by any way ❤

Labels ?

Anti-debugging IsDebuggerPresent Debugger/tool window detection TLS callback String / data encryption XOR Control-flow obfuscation Indirect / computed jumps & calls Import / API obfuscation

Comments (9)
Writeups (2)

You must be logged in to post a comment

S90x123 on 2026-07-28 20:44: [Click to reveal]

S90x123 on 2026-07-28 20:44: Okay, take this hint to make it easier the program doesn't check against a hardcoded plaintext password; it compares hashes. If you analyze the program, you'll find the password has a specific length (won't spoil it, it's easy to figure out), and the target hash is: 0x60FAF8E6u So, the solution is to write a keygen that generates random strings quickly matching that password length, hashes them, and checks if they equal 0x60FAF8E6u. There are about 2.26 \times 10^{29} possible combinations, and any of them will win the challenge easily. As for thinking this is crazy not at all but there are ways to do about millions attempts per second like using Xorshift RNG with pure bitwise operations Okey i will give you a simple password ``` G1GXMTTvx&Is3rnoJ@S7 ``` or ``` R3v3rse_M3_1f_U_Can! ``` try to get another password

S90x123 on 2026-07-28 20:45: Oh I sent it 2 time 🤣🤣

S90x123 on 2026-07-29 15:46: @UmerMehboob good job 👏 At lest you take the hint and try to make it on the real Not only talking with out do any thing 😂 Good job ❤️🤜

1GuardiaNN on 2026-07-30 03:34: [Click to reveal]

ludzof on 2026-07-31 17:33: Really elegant crackme. Defeated the anti-debug checks, then dumped the custom hashing routine at 0x140001540. Because the 20-byte input is split and hashed with derived seeds (seed2 = eax1 ^ 0xC001D00D), I wrote a parallel C# brute-forcer to target the 0x60FAF8E6 collision check. Crushed the search space in seconds. The fact that the success state executes a classic process injection directly into explorer.exe (and spikes the CPU) was a fantastic touch. Excellent work on this one. writeup submitted

S90x123 on 2026-08-02 13:15: @ludzof ❤️👌good job

pidorCrackerBitch on 2026-08-07 18:39: 000000000079100e4710

Zafer on 2026-08-08 11:36: [Click to reveal]

Show all spoilers

You must be logged in to submit a writeup

Solution by UmerMehboob on 2026-07-29 04:15:
Static analysis solve: reconstructed the custom 32-bit hash-based password check, bypassed the TLS-callback anti-debug layer without ever running the binary, and wrote a keygen.

View

Solution by ludzof on 2026-07-31 17:31:
This crackme requires finding a 20-character password. It employs anti-debugging techniques, a custom multi-stage hashing algorithm, and process injection (which acts as a payload/check upon success).

View

crackmes.one

crackmes.one

S90x123's hard crack me