| easy-licensecheck |
wallet_addresses |
damn boy , solved |
2025-06-17 22:14 |
View |
| Ransomware |
torontotokyo |
Flag is F4N_N3R0{W3lc0m3_t0_my_pr0f1l3_7h1s_1s_my_w@ll3t_k3y} |
2025-06-15 11:49 |
View |
| CrackMe |
Berardinis |
|
2025-06-15 06:46 |
View |
| Mike's Virtual Machine |
crackerfg |
Solution by manually analyzing VM handlers |
2025-06-13 18:14 |
View |
| EasyCrackme |
RandomTryDude2 |
Simple solve for this one , for a newbie , simple discovers of strcmp |
2025-06-12 09:32 |
View |
| easy crack me by lerta |
Berardinis |
|
2025-06-11 22:06 |
View |
| agent_1337 |
Berardinis |
After analyzing the program in IDA Pro and making several attempts with the correct values, we arrived at the following input:
```
welcome agent 1337, the evil group 0xL0CCEDC0DE has stolen 1337 BILLION dollars, you MUST get it back...
for your first take you must hack into the admin account
0: enter username, 1: enter password, 2: login 0
enter ur username: AAAA
0: enter username, 1: enter password, 2: login 2
please try again as an admin!
0: enter username, 1: enter password, 2: login 1
enter ur password: root
0: enter username, 1: enter password, 2: login 1
enter ur password: IAMROOT1337
0: enter username, 1: enter password, 2: login 2
stage 1/2 of logging in done...
stage 2/2 of logging in done...
good job agent 1337! you must now use ur secret device to change the code to unlock the door! the current code is ABCD and you must change it!
%.4919d%8$n
....
YOU MADE IT agent 1337 you now have to get the money and escape
wait is someone here?
so mr 1337... you made it into our building... you want this money so bad right?? ok than, say my name and ill give it to you!
what is my name?: stackpointer
you did it... fine i guess you can have the money back
AGENT 1337 YOU DID IT!
```
To determine the flag in the final stage, a Python script was written.
Flag: `stackpointer` |
2025-06-11 07:28 |
View |
| Super easy password crack for kids |
grosFr0mage |
|
2025-06-10 12:55 |
View |
| RustVMgeddon |
Berardinis |
|
2025-06-10 11:00 |
View |
| BluePrint |
nukoneZ |
nukoneZ |
2025-06-09 08:42 |
View |
| Crackme0x00 |
Prometheus138026 |
|
2025-06-09 02:30 |
View |
| Unconventional JavaScript HTML Crack Me |
RCEwithPeter |
|
2025-06-08 19:46 |
View |
| vuln |
nds |
if need modify,please inform me! |
2025-06-07 03:08 |
View |
| Fatmike's Crackme #7 |
Elvis |
- A write up in Markdown format
- IDB database
- x64dbgpython script
- IDAPython script
- A keygen in python script |
2025-06-06 09:13 |
View |
| Password encryption using XOR method |
comp |
python .\index.py
011988575430119 |
2025-06-06 03:34 |
View |
| Password encryption using XOR method |
Berardinis |
❯ python3 secret_finder.py sCPZSUPgTG@G^C] CrackmePassword
2025-06-05 09:15:47,666 [INFO] Detected key length: 11
2025-06-05 09:15:47,666 [INFO] Key bytes: 30 31 31 39 38 38 35 37 35 34 33
Secret word (raw): 01198857543
Secret word (escaped): 01198857543 |
2025-06-05 06:21 |
View |
| TryCrackMe (v1) |
Berardinis |
Unpacked the executable:
upx -d Trycrackme1.exe -o TryCrackMe-unpack.exe
Analyzed the algorithm in IDA Pro, focusing on the following functions:
sub_466C74
sub_466CB8
sub_4669AC
sub_466B40
sub_466B64
sub_466A7C
Wrote a serial code generator in Python.
Here's an example of its output:
python serial_gen.py Example
2025-06-02 05:00:01,389 [INFO] Seed initialised to username length: 7
Example → 2P7O-437O-5N54-6R |
2025-06-02 15:44 |
View |
| Entry Level Keygen-Me 0.01a |
EvESpirit |
Lovely challenge!
Straightforward main, which called the function sub_4011A0(_DWORD *this, char *Str) - a regex validator. Strict format checking as expected, if it's not "NNNNN-TOM-NNNNNNN-NNNNN", we're going nowhere. If it's valid, we go to sub_401220.
sub_401220 is our validator.
First check takes the first 5-digit part of your serial, and checks divisibility by 7.
Second check creates a small 3-character string made from the last digit of the first checkee from earlier, the 6th character of our input which automatically means it has to be a dash due to the validator regex, and the 7th character of our input which automatically means it has to be T for the same reason. After this, we get this check:
if (sub_401C40(temp_str, "000")) { /* fail */ } else { /* success */ }
sub_401C40(temp_str, "000") is called, and if it doesen't return a 0, we fail.
Perfect opportunity for binary patching? Yes, but we soldier on.
sub_401C40 was a bitch.
sub_401C40(char* 3_char_string, char* literal_000) just calls sub_40D5C0(literal_000).
3_char_string seems to be ignored as the this pointer for sub_40D5C0 which is __thiscall. Instead, literal_000 becomes this, and 3_char_string is passed as the first actual argument on the stack.
Then we calculate len(3_char_string). This, obviously, always comes out as 3.
Then we try to get some out-of-bounds garbage. Suprisingly enough, consistent garbage. The subsequent std::_Traits_equal is probably just a string comp, possibly for char16_t - but most importantly, it compares to our 3_char_string.
It seems that std::_Traits_equal in this specific context, with the OOB read and potential type confusion, effectively considers 3_char_string "not equal" to its internal representation of "000" only when the first character of 3_char_string is '0'.
TL;DR:
Your serial must be NNNNN-TOM-NNNNNNN-NNNNN.
The first 5-digit part (NNNNN) must be divisible by 7.
The last digit of that first 5-digit part must be '0'.
The other two numeric parts can be anything.
From this point, it's extremely easy to write a script to give you a bunch of keys. They all return the same flag - WPVUF@PMFMVMLUCD. |
2025-05-31 01:30 |
View |
| easyjerk |
duffyevan |
:) |
2025-05-30 02:03 |
View |
| My First Rust Crackme |
Berardinis |
|
2025-05-29 20:12 |
View |
| Lord Winderton |
Jenya |
thenk you its was fun |
2025-05-29 13:55 |
View |
| VM and OBF and Anti-Debug(primitive) |
Berardinis |
|
2025-05-29 01:11 |
View |
| nuclearhp crack |
wildroar |
Run this python script and you will get the explain |
2025-05-28 20:18 |
View |
| lilbitofthislilbitofthat |
coldbingchilling |
decompile program to see that it is validating serials by performing lookups into the 52-char len array (abcedf....xyzABCDEF....XYZ).
copy implementation in python to solve |
2025-05-27 19:23 |
View |
| For education (XOR) |
Nandies |
Xor key: 0x5A
Login: admin
Password: 12345 |
2025-05-27 13:02 |
View |
| nuclearhp crack |
WM |
Serial phishing - wtf? Here you go, "keygen" |
2025-05-27 12:27 |
View |
| Simple CrackMe |
masterofcode |
Good crackme, use of strings from user prompts, make it easy to narrow in on, so shouldn't be too hard for newer people. |
2025-05-26 21:00 |
View |
| easyjerk |
Snxhit |
Detailed solution with keygen.py and source code inside! :D
Was a very fun crackme, ty vulnix! |
2025-05-25 19:18 |
View |
| EasyCrackme |
DnOnith |
|
2025-05-25 13:29 |
View |
| moofys_simple_keygenme_1 by moofy |
hubertf |
Full HowTo at https://www.feyrer.de/redir/ghidra+windsurf-HowTo.html
Greeting - hubertf
|
2025-05-25 12:30 |
View |
| MyFirst |
wutan |
|
2025-05-24 09:20 |
View |
| Crackme medium |
WebMarginal |
Analysis Approach
I began by examining the program using IDA Pro, focusing on key verification functions. Initial static analysis revealed anti-debugging measures and string constants related to serial key validation.
The main validation function was identified at address `0x1400140D0`, which implements a non-trivial algorithm to verify user-provided serial keys.
Key Verification Algorithm
The algorithm enforces the following constraints:
1. The key must be exactly 10 characters long
2. All characters must be alphanumeric
3. The program calculates a checksum value `v4` using each character's ASCII value:
v4 = 0
for j = 0 to 9:
v4 += ((j + 5) ^ ASCII(key[j])) - 3*j
4. The key is valid if and only if: `(v4 ^ 0xDEAD) % 997 == 133`
The Go implementation was chosen for its speed and efficiency, allowing for rapid testing of millions of key candidates. The keygen employed a random search approach, though more optimized techniques could be used for faster results.
Results
After checking approximately 43.4 million candidates, a valid key was found:
- Key: `dyqqustupp`
- v4 value: 1072
- (1072 ^ 0xDEAD) % 997 = 133
Manual verification confirmed this key passes all validation checks in the CrackMe application.
Security Assessment
The key validation scheme employs several interesting techniques:
- Modular arithmetic with a large prime (997)
- XOR operations with a magic constant (0xDEAD)
- Position-dependent character processing
- Anti-debugging countermeasures
However, the algorithm's security relies on obscurity rather than cryptographic strength. With sufficient computational resources, valid keys can be discovered through brute force, as demonstrated.
|
2025-05-23 20:05 |
View |
| Validator (easy) |
honorbuddy |
Simple, good crackme for beginners |
2025-05-21 20:25 |
View |
| MyFirst |
honorbuddy |
Cool crackme - simple but i have to think to solve it.
So password - Boozy (btw for first try i've thought password is Booty) |
2025-05-21 20:10 |
View |
| EasyCrackme |
jtjones73 |
Password: .rdata
Easy crack - fixed password, visible in strings but hidden in plain sight, it does check for buffer overflow. |
2025-05-20 23:50 |
View |
| Very Easy Crackme |
biasxed |
password ends up being ":Rew." The crackme is looking for the password to end up being "0x54a337" but it goes through some changes from when its inputted into the program to when its compared to 0x54a337 so we just do those changes in reverse and bruteforce different password lengths with different ascii character combinations until it works ends up being 0x54a337. (from what I understand I'm not very good at this stuff) |
2025-05-19 08:38 |
View |
| Simple CrackMe |
KK12109 |
使用ghidra新建一个项目，分析exe，然后找到入口方法，把反编译代码丢给ai，main方法便跃然而出，接着便是没有加密没有混淆的答案：QuiteEasyRight
Having created a new project in Ghidra and analyzed the executable, the entry point was readily identified. By providing the decompiled code to the AI, the main function was clearly revealed. Subsequently, without any encryption or obfuscation, the answer 'QuiteEasyRight' was immediately apparent. |
2025-05-18 12:54 |
View |
| Validator (easy) |
BlockLoader1 |
ezz |
2025-05-18 08:08 |
View |
| My First Rust Crackme |
Platinumxy |
Remember kids manipulate the users input not the key :p |
2025-05-15 23:50 |
View |
| Advanced Persistent Threat |
hexamine |
fun challenge, would have been a lot easier had I solved it with debugging and replaying the traffic, instead of just static analysis. LOL. |
2025-05-14 19:15 |
View |
| reverse_rengr |
Zapz42 |
Try not to check the solution, beginners — you can do it easily, I believe in you |
2025-05-13 21:20 |
View |
| Super easy password crack for kids |
Zapz42 |
Really easy, but good for kids/beginners
Never stop learning & keep pushing |
2025-05-13 20:59 |
View |
| Validator (easy) |
PinkWhale |
|
2025-05-13 17:41 |
View |
| Validator (easy) |
Zapz42 |
rly easy chall |
2025-05-13 15:17 |
View |
| BluePrint |
hexamine |
cool chal :p |
2025-05-12 10:38 |
View |
| reverse_rengr |
mangocracks |
PDF of my exported md of the solution |
2025-05-12 09:18 |
View |
| hell |
zi0n |
|
2025-05-05 20:41 |
View |
| Crack me for beginners |
Txnshi |
No Ghidra or any Third Party Software needed |
2025-05-05 12:51 |
View |
| Liscence Validator |
SoloPietro |
|
2025-05-03 22:31 |
View |
| License KeyGen By 999 |
zi0n |
|
2025-05-03 20:38 |
View |
