crackmes.one

-
Search Latest Scoreboard Faq Discord Blog CTF Login Register

crackmes.one

Latest Solutions Latest activity RSS

Crackme Author Summary Date Action
flags TheNam1sOut 2025-08-19 15:19 View
keygenme_2_by_nicohogtag by nicohogtag georgepaphitis 2025-08-19 12:29 View
Easy for begin S3c_Cult 2025-08-19 09:12 View
Very Easy Crackme yansyn a very simple solution 2025-08-19 08:24 View
Very easy disassembly execise karabatik Static analysis of the main function shows a simple hardcoded comparison with value 124816. Password = 124816. 2025-08-18 16:59 View
emulation loader karabatik # CrackM Writeup - karabatik ## Overview This writeup details the solution for the `crackmemain.exe` CrackMe challenge. The binary implements function pointer obfuscation and anti-debugging techniques, making it an interesting reverse engineering exercise. ## Initial Analysis ### File Information - **Filename**: crackmemain.exe - **Size**: 0xCE00 (52,736 bytes) - **MD5**: 592f7a190c872f6091dfad0e4fb9ee61 - **Architecture**: x64 Windows PE - **Base Address**: 0x140000000 - **Entry Point**: 0x14000a280 ### Runtime Behavior Running the executable shows a simple login prompt: ``` **********Welcome to CrackMe Loader..... Enter Login: test Enter Password: password Fail! Total pause: 0ms Press Enter to exit... ``` ## Static Analysis with IDA Pro ### Main Function Analysis The main function is located at `0x140001ab0` and contains several interesting features: 1. **Function Pointer Obfuscation**: All function calls are obfuscated using a magic number `0x2CC634AC8CA6AD95` 2. **Anti-Debug Protection**: Multiple conditional checks against global variables 3. **String Encryption**: All strings are encrypted and decrypted at runtime ### Key Functions Identified - `0x140001ab0` - Main function (1466 bytes) - `0x140002070` - Dynamic API loading - `0x140002600` - Anti-debug mechanism with 5x500ms delays - `0x140002d30` - **Validation function (TARGET)** - `0x140001230` - String processing utilities ### Deobfuscating Function Pointers The obfuscated function pointers follow this pattern: ```c ((void (*)(void))((char *)off_14000D150 - 0x2CC634AC8CA6AD95LL))() ``` To deobfuscate: `real_address = obfuscated_pointer - 0x2CC634AC8CA6AD95` ## Deep Dive: Validation Function ### Function Analysis The critical validation logic resides in `sub_140002D30`. After decompiling, the function reveals: ```c strcpy(v43, "panhauzer"); // Expected login strcpy(v42, "2digboob"); // Expected password ``` The function performs complex string comparison using regex-like pattern matching, but ultimately returns: - `1` for successful authentication - `0` for failed authentication ### Hardcoded Credentials Through static analysis, I discovered the valid credentials: - **Login**: `panhauzer` - **Password**: `2digboob` However, testing these credentials would be the "intended" solution. Instead, I chose a more elegant approach. ## Solution: Binary Patching ### Approach Rather than finding the exact password, I decided to patch the validation function to always return success. This demonstrates a common real-world attack vector. ### Patch Implementation **Target Address**: `0x140002d30` (start of validation function) **Original bytes**: ``` 41 57 41 56 56 57 ... (complex validation logic) ``` **Patched bytes**: ``` B8 01 00 00 00 C3 ``` **Assembly equivalent**: ```assembly mov eax, 1 ; Return success (1) ret ; Exit function immediately ``` ### Patching Process 1. Navigate to address `0x140002d30` in IDA Pro 2. Switch to Hex View 3. Press `F2` to enter edit mode 4. Replace the first 6 bytes: `41 57 41 56 56 57` → `B8 01 00 00 00 C3` 5. Press `F2` to exit edit mode 6. Save the patched binary ## Results After applying the patch, any login/password combination is accepted: ``` **********Welcome to CrackMe Loader..... Enter Login: anything Enter Password: whatever DLL Inject Success! [EMU] Total pause: 0ms Press Enter to exit... ``` The success message "DLL Inject Success! [EMU]" confirms the bypass worked perfectly. ## Alternative Solutions ### Method 1: Using Hardcoded Credentials The "intended" solution would be using the discovered credentials: - Login: `panhauzer` - Password: `2digboob` ### Method 2: Runtime Patching Instead of modifying the binary, one could: - Use a debugger to set breakpoint at `0x140002d30` - Modify the EAX register to return 1 - Continue execution ### Method 3: DLL Injection Advanced users could inject a DLL to hook the validation function and force it to return success. ## Technical Insights ### Anti-Analysis Techniques Observed 1. **Function Pointer Obfuscation**: Makes static analysis more difficult 2. **String Encryption**: Hides meaningful strings from basic analysis 3. **Anti-Debug Delays**: 5x500ms delays slow down dynamic analysis 4. **Complex Control Flow**: Multiple nested loops and conditions ## Tools Used - **IDA Pro 9.0**: Static analysis and disassembly - **Hex Editor**: Binary modification --- **Author**: karabatik **Date**: 08/18/2025 **Difficulty**: 4/10 **Primary Technique**: Binary Patching 2025-08-18 10:29 View
Non-cryptographically secure hash (my first crackme!) RodrigoTeixeira This is both the creator's solutions. 2025-08-18 00:14 View
Ransomware scaredandalone cool challenge :D 2025-08-17 13:58 View
LoginCrackme georgepaphitis 2025-08-16 13:10 View
Building Rust With Bob georgepaphitis 2025-08-14 15:07 View
hacktooth crackme #4 GoatFoo Write up in markdown, patch included as script to follow along 2025-08-12 13:44 View
pixy georgepaphitis 2025-08-11 14:50 View
CrYP70NYM'S CRACKME FIXED georgepaphitis 2025-08-11 14:48 View
CrackMe georgepaphitis 2025-08-11 11:12 View
Find the embedded serial code leaves Code obfuscation is very annoying to deal with. Using break points and jumps with a debugger can make things easier. 2025-08-10 13:30 View
int overflow georgepaphitis 2025-08-09 15:48 View
CrakasMe GiusNasxieng 2025-08-05 05:03 View
Dll is so hard! scaredandalone My writeup, let me know if anything is inaccurate. Feedback is appreciated. Cheers. 2025-08-05 03:19 View
InDuLgEo V3-B — The DOS Intro Challenge sa2304 Solution described in solution.txt. InDuLgEo_V3-B_sa2304.png is a screenshot of cracked program. InDuLgEo_V3-B_sa2304.CoM is the cracked program. cracked-by.txt holds text that replaced original strings. 2025-07-30 13:09 View
CrackMe For Noobs | EZ Anti-debug | Ez String-Encryption cleric 2025-07-27 03:23 View
c++ vm test cleric 2025-07-27 02:06 View
makeKEYgen Ok123123 2025-07-26 23:37 View
Shuffle luckyroo711 2025-07-26 00:31 View
main.cpp MAS notion link : https://internal-nerine-7c4.notion.site/Solving-main-cpp-by-toasterbirb-Full-Walkthrough-238db5c71836806ea7fecc107ada6d04?pvs=143 2025-07-22 21:48 View
VMAdventures 1 connor 2025-07-19 17:26 View
easiest crackme mffajari 2025-07-18 03:16 View
makeKEYgen Stingered Solution provided by Stingered (2025) 2025-07-14 15:19 View
Shuffle ahmeep Simple shuffling. Use the decompilation of the program to figure out the unshuffling algorithm. 2025-07-10 12:31 View
CrackMe_By_InDuLgEo_V1 SorinSalam 2025-07-09 06:08 View
0xL0CCEDC0DE'S REVENGE ahmeep exploit your way. 2025-07-08 16:14 View
Follow the asm call! ahmeep SECRET{D0n_wtf_did_u_do} 2025-07-07 16:42 View
crackme2 april7 full write up 2025-07-05 22:25 View
easiest crackme johnsmith27 verysecret69 2025-07-05 18:46 View
InDuLgEo V3-B — The DOS Intro Challenge Ja4V8s28Ck 2025-07-05 16:40 View
InDuLgEo V3-B — The DOS Intro Challenge nightxyz 2025-07-04 08:43 View
timotei crackme#10 bejolo Here I left the solution explained as easy as I can do. Hope useful for someone. Thanks for this crackme. Love it 2025-07-03 16:11 View
A CrackMe by ByteClassic (on yt) TUNGGGG Author: T9999 Instruction of ByByteClassic challenge 2025-07-01 09:32 View
A CrackMe by ByteClassic (on yt) AnonJelly 2025-07-01 05:00 View
Crackme protect aum Type: Reverse Engineering Protection: Heavy obfuscation, misleading symbol names, hardcoded logic Tools Used: dnSpy, debugger 2025-06-30 12:30 View
First Crack Me aum - Password check bypassed without guessing - Legit success message and behavior - All logic preserved, no dirty hacks 2025-06-28 12:54 View
zrox's crackme easy aum Opened in dnSpy. Found hardcoded password in btnLogin_Click method. No obfuscation or patching required. 2025-06-28 11:24 View
Simple anti-tamper 1.0 by Darkgate Stingered Here is my write-up for Darkgate's simple anti-tamper v1.0 by Darkgate in text-only format. 2025-06-21 18:49 View
PrettyDamnEasy CloudArc0 I mean... it's pretty Damn Easy --(0-0) 2025-06-20 12:41 View
Very easy Meloch 2025-06-19 17:46 View
Very easy authand Looking at the disassembly you can see the mathematical operations being done which you can then convert into python to write a keygen: def main(): for i in range(100): print(f"{i}:{gen_key(i)}") def gen_key(original_input): copy_input = original_input # mov eax, edx copy_input 2025-06-19 12:22 View
Very easy jaghut_chad 2025-06-18 18:32 View
My First Crackme 0xpr3m solution is in the txt file attached 2025-06-18 13:26 View
Lookmeup stackpointer7 the file explains how the code works and has a keygen 2025-06-18 03:56 View
A CrackMe by ByteClassic (on yt) wallet_addresses damn 2025-06-17 22:23 View
Very easy wallet_addresses check 2025-06-17 22:19 View
Previous Page 20 Next