| chainbreaker |
MostafaGalal |
Reverse-engineering of Chainbreaker with proper variable renaming, analysis of the state-transition logic, and a simple Python solver that finds a valid seed by accurately emulating C integer behavior. |
2026-02-23 06:31 |
View |
| BobxReal You Can't do it V2 ;) |
OB_BUFF |
# bobxREAL.exe Reverse Engineering Report
## 1) Scope and target
- Target: `bobxREAL.exe` (x64 PE)
- Goal: find password validation logic and build a practical keygen/solver.
- Tools used:
- IDA Pro (+ ida-pro-mcp) for static RE.
- x64dbg (+ x64dbg-mcp) for runtime checks.
- PowerShell for repeated execution/statistics.
## 2) High-level behavior
- Program prints `Password:` and reads up to 64 bytes (`fgets`), then strips CR/LF.
- It hard-gates input length:
- `len != 16` -> immediate wrong path.
- `len == 16` -> enters randomized state-machine verification.
- Final success condition is not a classic direct `strcmp` with a fixed key.
## 3) Core logic (IDA)
Main function:
- `main` at `0x140005620`.
- Loop starts with `v33 = 0x11` and repeatedly dispatches:
- function index = `(v33 ^ dword_140030B58) % 10`
- target function from shuffled table `qword_140030E10[...]`
- `v33 = callee(Str, &state)`
- Stops when:
- `v33 == 0x99` -> success path (`Correct!`)
- `v33 == 0xFF` or null function pointer -> fail path (`Wrong.`)
Important handlers in the state table:
- `sub_140004220` -> returns `0x22`
- `sub_140004230` -> anti-debug/anti-VM checks, returns `0x33` or `0xFF`
- `sub_1400044A0` -> `sub_140001810` gate, returns `0x44` or `0xFF`
- `sub_1400044D0` -> `sub_1400015E0` gate, returns `0x55` or `0xFF`
- `sub_140004500` -> hash consistency gate, returns `0x66` or `0xFF`
- `sub_140004520` -> VM-like transform over input, returns `0x77` or `0xFF`
- `sub_140004770` -> arithmetic check, usually leads to `0x88`
- `sub_140004790` -> CRC/anti-check stage, returns `0x99` or `0xFF`
- `sub_140004A60` -> returns `0x99` directly
- `sub_140004A70` -> returns `0xFF` directly
## 4) Why there is no fixed deterministic password
- The dispatch key `dword_140030B58` is continuously perturbed by multiple background threads (`sub_1400052E0`, `sub_1400053B0`, `sub_140005470`, `sub_140004A80`) and timing/exception side effects.
- State transition order therefore changes between runs.
- Some transitions immediately fail (`0xFF`) regardless of input; some eventually reach `0x99`.
- Empirical evidence shows near input-independence for 16-char strings.
## 5) Dynamic validation (x64dbg + repeated runs)
Observed behavior from repeated runs:
- Any 16-char input can produce `Correct!` on some runs.
- Non-16 lengths always fail.
Measured sample (PowerShell, 40 runs each):
- `AAAAAAAAAAAAAAAA` -> 18/40 success
- `BBBBBBBBBBBBBBBB` -> 17/40 success
- `0123456789abcdef` -> 14/40 success
- `!!!!!!!!!!!!!!!!` -> 19/40 success
- `short` (len 5) -> 0/40
- len 17 sample -> 0/40
Conclusion:
- This crackme is a race/randomized validator.
- "Key" condition is effectively: **exactly 16 chars**, then retry until favorable scheduling/state.
## 6) Practical keygen strategy
- Generate any 16-char key.
- Optionally auto-run the target in a loop until `Correct!` appears.
Delivered tools:
- `bobxreal_keygen.ps1` (Windows-native, tested)
- `bobxreal_keygen.py` (same logic, requires Python)
Features:
- generate random key (`len=16` default)
- run once (`--run`/`-Run`)
- auto-win mode (`--autowin`/`-AutoWin`, retries until success)
## 7) Notes and decoys
- Hardcoded strings like `FLAG{BOBXFRCRACKXD}` and `_the_real_flag_12345}` exist in code/data paths but are decoys and not a normal fixed password check.
- Environment variables (`BOBX_ENABLE_*`) toggle anti-analysis features but do not convert this into a single static valid key.
## 8) Reproduction commands
Generate key only:
```powershell
powershell -ExecutionPolicy Bypass -File .\bobxreal_keygen.ps1
```
Try once:
```powershell
powershell -ExecutionPolicy Bypass -File .\bobxreal_keygen.ps1 -Run
```
Auto-pass:
```powershell
powershell -ExecutionPolicy Bypass -File .\bobxreal_keygen.ps1 -AutoWin -MaxAttempts 300
```
Use your own key:
```powershell
powershell -ExecutionPolicy Bypass -File .\bobxreal_keygen.ps1 -Key AAAAAAAAAAAAAAAA -AutoWin
```
|
2026-02-23 01:26 |
View |
| EasiestEver |
Anarcocapetista |
Solving the EasiestEver crackme with Ghidra. Targeted to beginners. |
2026-02-22 14:46 |
View |
| Easy crackme |
mystergaif |
# Writeup for Easy crackme by maxpsger
## Tools Used
* **Ghidra** (Static Analysis)
## Analysis Process
1. **Initial Analysis**: I loaded the binary into Ghidra and performed the standard auto-analysis to recover the program structure.
2. **Function Renaming**: To simplify the reversing process, I identified and renamed the core subroutines based on their signatures and logic.
3. **Locating Main**: I navigated to the `main` function to analyze the execution flow.
4. **Credential Recovery**: Inside the logic of the `main` function, I found a straightforward comparison of user input with hardcoded strings. The algorithm was clear and easy to read.
## Solution
The binary expects the following credentials to grant access:
Username: crackme
Password: Rickroll
|
2026-02-21 14:34 |
View |
| GrannysQuest |
Kanker1337Off |
Hello to everyone reading this WriteUp. I want to say that the idea of this crackme is pretty cool, but the implementation is of course weak, just like the 'protection' itself. The thing that took me the most time was realizing that my nickname wasn't supported because it was longer than 8 characters:
do {
cout << "nYour name: ";
cin >> unk_14000C0C0;
} while (length(name) > 8);
It took me about 10 minutes to realize this, and the whole quest took about the same time (at first I thought it was a bug and my nickname just wasn't being accepted xD). I used a translator to write the entire text in English, so sorry if some terms were translated incorrectly. |
2026-02-20 22:51 |
View |
| Easy crackme |
idanhajbeko |
explaining everything step by step
uses --math-- to determine how many valid keys (spoiler: a lot!) |
2026-02-17 20:25 |
View |
| Bingus |
kefir_absorber |
Solved using static analysis in ghidra |
2026-02-17 18:22 |
View |
| MCM 2.0 |
Cyberseal |
The Following URL Contains the full Writeup https://github.com/SFRDevelopment/CrackNotMe-s-MCM-2.0 Was Fun! |
2026-02-13 14:40 |
View |
| qcrk_2 by qnix |
stackpointer7 |
This assembly file contains a writeup and code to get the flag |
2026-02-10 15:32 |
View |
| Monster CrackMe 1.0 (MCM) |
djd320 |
nice crackme, you could split one key constant between parent and child and randomize small vm constants per run to make it harder. |
2026-02-10 09:45 |
View |
| Continental |
djd320 |
the main weakness is the hash compression step caused by left shift then byte truncation.
if uniqueness is desired, avoid lossy truncation in the core check path. |
2026-02-09 19:12 |
View |
| admin_panel |
jackoverflow |
it's my first write up :) |
2026-02-09 08:52 |
View |
| ez crackme |
marco007 |
pretty hard tbh read the writeup :) |
2026-02-08 00:40 |
View |
| Password And Flag in C |
marco007 |
Thanks for creating this crackme, it was fun to solve! |
2026-02-07 21:41 |
View |
| Quite a simple crackme |
marco007 |
First crackme I tried from this website :) |
2026-02-06 00:04 |
View |
| PlsCrackMe |
pyderall |
No patching was used; only static analysis and understanding of the input handling bug. |
2026-02-05 13:02 |
View |
| FedGuy easy crack |
svidnet |
A simple write up for this crackme |
2026-02-03 13:50 |
View |
| Simple Keygen |
Adriik |
A static analysis, first using objdump and then Ghidra. The program that generates valid keys is written in C. |
2026-02-02 19:56 |
View |
| EasyVM |
Katjri |
You can also read on : https://kajrivn.github.io/PersonalBlog/blog/EasyVM.
Nice challenge! |
2026-02-02 14:25 |
View |
