lihe07's not obfuscated

Author:
lihe07

Language:
C/C++

Upload:
2026-08-27 23:25

Download

Platform:
Unix/linux etc.

Difficulty:
5.0

Quality:
4.0

Arch:
x86-64

Downloads:
77

Size:
30.30 KB

Writeups:
1

Comments:
2

Description

Try to understand the algorithm and find the input that triggers "correct!"

Labels ?

Self-modifying / runtime decrypt Code virtualization / VM Custom / generic obfuscation

Comments (2)
Writeups (1)

You must be logged in to post a comment

anatolianrev on 2026-08-28 08:49: [Click to reveal]Got there eventually. The title is half a lie btw. Sure, nothing is obfuscated, but the entire password check is a neural network compiled at runtime, which I did not expect. So the binary mmaps a region, fills it with generated x86 (you can grab it with a breakpoint right after the mprotect call, super convenient) and calls into it. The generated code is a little stack machine running some functional program. Took me a while to even see the shape of it because everything is recursive map/fold style calls instead of a normal loop. What it actually computes is a 3 layer fully connected net. 49 inputs, two hidden layers of 64, 10 outputs. Integer weights, ReLU on the hidden layers, and the final check is just argmax over the last layer. You need output 1 to be the winner, anything else prints nope. Class 10 is what you get when nothing wins (all zeros input gives 10, that gave away the initial value of their fold). The password is 49 numbers between 0 and 10, fed one per line. Cute trap in the parser: anything bigger than 10 or not a number at all silently becomes 0, so typos just shift your input instead of erroring. How I solved it: dumped the weights straight off the VM stack with ptrace (they just sit there in the buffer between layers), rebuilt the net in numpy, checked it agrees with the real binary on a bunch of random inputs, then hill climbed the margin between logit 1 and its strongest competitor. Found a winner almost immediately. Guess the net was never meant to resist that kind of attack, it only has to resist guessing. Working password if you want to verify: 1 8 10 5 10 8 9 8 0 5 0 6 6 7 2 7 0 7 5 1 0 1 1 1 10 6 9 4 5 1 9 4 4 8 10 8 4 1 5 3 8 7 5 4 2 1 7 9 4 One per line, as digits. There are for sure many other valid ones since the hill climber finds them from random starts, but this one has a comfortable margin so it should not be fragile. Nice one lihe07, grading passwords with a classifier is a genuinely fun idea. First time I have to backprop through a crackme to get in.

lihe07 on 2026-08-28 20:09: [Click to reveal]

Show all spoilers

You must be logged in to submit a writeup

Solution by anatolianrev on 2026-08-28 09:16:
Dissecting the generated checker: the 117KB JIT dump, the CPS stack machine, the 49-64-64-10 integer classifier it hides, weights baked in as immediates, and a margin hill climb to argmax 1.

View

crackmes.one

crackmes.one

lihe07's not obfuscated