Latest solutions

Crackme	Author	Summary	Date	Action
Find the pass	lfanew	Program takes a string from user, hashes value and compares to the expected hash at 00405064 - "pcx\|xpzlhgu}" Two things stood out to me in this challenge. #1 - The compiler optimization for division. 004014b1 ba67666666 mov edx, 0x66666667 004014b6 89c8 mov eax, ecx 004014b8 f7ea imul edx 004014ba c1fa02 sar edx, 0x2 The above code is equivalent to simply dividing edx by 10, or (edx / 10). The reason for this has to do with a compilers affinity for working in powers of 2's and the cost of the division instruction. A good read on this can be found at: http://blog.dkbza.org/2007/09/reverse-engineering-compiler-produced.html A good reference on these operations can be found at: https://flaviojslab.blogspot.com/2008/02/integer-division.html #2 - Using an unnecessarily large buffer 00401472 8b4508 mov eax, dword [ebp+0x8 {pass}] 00401475 890424 mov dword [esp {var_6c_1}], eax 00401478 e88b270000 call strlen 0040147d 8945ec mov dword [ebp-0x14 {var_18}], eax 00401480 8b45ec mov eax, dword [ebp-0x14 {var_18}] 00401483 c1e002 shl eax, 0x2 00401486 890424 mov dword [esp {var_6c_2}], eax 00401489 e8da270000 call malloc // make the hashed password buffer 4x bigger The above code shows that the program gets the length of the password. We then allocate memory to that length shifted left 2 times. At first I wasn't sure of the purpose of why the developer did this until the end of the hashing function. 0040149a mov eax, dword [ebp-0xc {i}] 0040149d lea edx, [eax4] // store i 4, aka i shifted left by 0x2 004014a4 mov eax, dword [ebp-0x18 {offsets}] 004014a7 lea ebx, [edx+eax] // ebx now holds offsets[i4] 004014aa call rand 004014af mov ecx, eax 004014b1 mov edx, 0x66666667 004014b6 mov eax, ecx 004014b8 imul edx 004014ba sar edx, 0x2 004014bd mov eax, ecx 004014bf sar eax, 0x1f 004014c2 sub edx, eax 004014c4 mov eax, edx 004014c6 shl eax, 0x2 004014c9 add eax, edx 004014cb add eax, eax 004014cd sub ecx, eax 004014cf mov edx, ecx 004014d1 mov dword [ebx], edx // store the current offset at offsets[i4] 004014d3 add dword [ebp-0xc {i}], 0x1 I believe the reason for this is just throw a bit of confusion to the reverser. This way there will be 4 junk bytes between each hash offset in memory and will no longer be contiguous in memory. Conclusion: Other than those two things it just has a bit of math for the hashing function to get the offsets. I hope this read helps you :)	2021-05-10 05:39	View
Easy Crackme	DirkD	I had fun with this quick easy challenge , i used ollydebug 1.10 :) I've included a pdf writeup with some screenshots.	2021-05-09 08:57	View
genme by cry971c	mpwastaken		2021-05-07 21:02	View
My_first_ever_crackme	bimkos	Simple and interesting!	2021-05-06 21:38	View
Peach's crackme	ezb2661		2021-05-06 13:43	View
VERY EASY VERY SIMPLE C CODE	Ralkey	my solution to get the password in a .PDF file with pictures :)	2021-05-05 16:54	View
glow wine [keygen practice]	shaybl569	Python simple keygen	2021-05-05 14:14	View
guild hall adventure Ch.2	Shadorain	What a fun crackme! Here is my solution in markdown, if you would rather a rendered version on a pretty site here is a link: https://shadorain.github.io/blog/Security/Reversing/Crackme_gha2. Hope you enjoy!	2021-05-05 14:08	View
insane password checker	pranav	A good crackme, eventhough it had too high difficulty rating. Was fun cracking it and making keygen especially.	2021-05-03 17:56	View
crack me idiot 2	sorting	Rename dnSpy.exe to somthing else	2021-05-03 17:22	View
keygenme1.blzbb by blzbb	m4syuka	rekt	2021-05-01 22:45	View
My_first_ever_crackme	D4RKFL0W		2021-05-01 17:21	View
crackme_1 by weeman3005	m4syuka	done	2021-05-01 11:56	View
BruteForceMe	pranav	A good one for a Level 1 crackme	2021-05-01 11:38	View
Look Closer	pranav	Fantastic crackme, no doubt! I was finally happy to solve a good crackme after a long time!	2021-05-01 03:35	View
very easy hardcoded	Nosiume	Just my solution on this channel, scroll directly to the bottom to skip all the explanations of how I analyzed this binary !	2021-04-29 13:07	View
jumpjumpjump	redkage	Found it using Cutter + IDA. Mostly IDA for debugging and checking the cmp values to understanding what was going on. And Cutter to decompile and have a better overall view of the program. Solution and explanations attached	2021-04-28 13:09	View
easy_reverse	redkage	Used Cutter for disassembly	2021-04-28 11:51	View
guild hall adventure Ch.1	Shadorain	What a fun crackme! Here is my solution in markdown, if you would rather a rendered version on a pretty site here is a link:https://shadorain.github.io/blog/Security/Reversing/Crackme_gha1. Hope you enjoy!	2021-04-26 01:23	View
Crackme_OF	bimkos		2021-04-25 18:15	View
Crackme not main	Shadorain	What a fun crackme! Tricky one as well! Here is my solution in markdown, if you would rather a rendered version on a pretty site here is a link: https://shadorain.github.io/blog/Security/Reversing/Crackme_CNM. Thanks!	2021-04-25 15:13	View
crypto_namecompanyserial_keygenme by c0dehaz4rd	ToMKoL	Funny crackme. Quite interesting to play with.	2021-04-25 10:25	View
easyAF	Shadorain	Here is a simple solution for this simple crackme, should be explained well. If you want a rendered markdown pretty solution: https://shadorain.github.io/blog/Security/Reversing/Crackme_easyAF	2021-04-23 02:31	View
unlockme	NobitaNobi	I made a KeyGen for it. For info, Just XOR the given array inside binary. Chears!!	2021-04-22 21:55	View
crackme	GaneshG	Did not understand ALL the code, but managed with some luck. Hack: If name is single character then key == 0. .py file takes name and spits out code	2021-04-20 20:12	View
nasm crack	Shad0wCloud	Yep, that was easy, just look up for &passwd in pseudocode	2021-04-20 13:14	View
easyAF	GaneshG	Markdown. "": Commands typed into terminal	2021-04-20 12:02	View
crackme	ori0n.x3	A detailed write-up and a keygen in Python	2021-04-18 23:10	View
Basis static	agarmash		2021-04-18 18:42	View
crackme	Sm9l		2021-04-18 15:06	View
KataVM -- Level 1	jeffli6789	This is an excellent crackme! Thanks!	2021-04-18 07:51	View
Keyg3n_M1#1	Shad0wCloud	Here's my solution. . . . Basicly, u need to debug this code and watch what happens with variables. The tricky one is that in first "if" we compare with hex 0xA (10 in dec), but then, in second "if" we sum up "v3" with decimal. So, that's all. Very nice for beginner.	2021-04-17 19:55	View
My_first_ever_crackme	NobitaNobi		2021-04-17 09:04	View
Basis static	Thanathot	Open file in hex editor or with the strings command in linux strings basic_static.exe strings.txt search the strings for CTF will result in: CTF{Y0U_d1D_1t_n1C3}	2021-04-16 16:08	View
lockcode	NobitaNobi	Make sure you enter escape characters if required... Enjoy!	2021-04-16 08:09	View
Crackme_OF	ori0n.x3		2021-04-16 03:32	View
Basis static	ori0n.x3		2021-04-15 17:34	View
My_first_ever_crackme	strngl		2021-04-15 14:28	View
My_first_ever_crackme	ori0n.x3		2021-04-15 02:39	View
easy_reverse	oracle	first solution	2021-04-14 12:07	View
0verney	internaut401	github link: https://github.com/Internaut401/CTF_Public_Writeup/blob/main/crackmes.one/0verney.md	2021-04-12 23:50	View
SecureSoftware v1.5	giacomo270197	The solution to the main question of the crackme	2021-04-10 16:10	View
CrackMe2 - Classical cipher	MrNatas	Thanks for the crackme! This is my first writeup and I hope it is up to par.	2021-04-10 00:14	View
SanSuu	rDFDyYI	there is no keygen in my solution, but there is a little explanation and 2 manually-calculated valid serial numbers	2021-04-07 14:52	View
Basis static	jerrycashmoney	1. Open the file in a debugger. 2. Find the ASCII string starting with "CTF"	2021-04-07 13:51	View
simple overflow	bimkos	Simple and interesting.	2021-04-06 18:42	View
crackme	bimkos	gcc -o crack crack.c && ./crack	2021-04-06 10:12	View
Crackme_OF	strngl		2021-04-05 18:55	View
chrisK's crackme v03. Try it, it's not that hard !	mstik13	Tools used: IDA, Cheat Engine, Reclass. 1. Keygen hpp and cpp. 2. Exaplanation File txt with key. 3. Flowchart Easy to Read	2021-04-04 02:22	View
crackme_you_sh**t v2	Danielix	i found that in your main you were checking username with the result of the function "crfcaewxsed(str)", simply that function is itself the keygen	2021-04-03 18:29	View

Program takes a string from user, hashes value and compares to the expected hash at 00405064 - "pcx|xpzlhgu}" Two things stood out to me in this challenge. #1 - The compiler optimization for division. 004014b1 ba67666666 mov edx, 0x66666667 004014b6 89c8 mov eax, ecx 004014b8 f7ea imul edx 004014ba c1fa02 sar edx, 0x2 The above code is equivalent to simply dividing edx by 10, or (edx / 10). The reason for this has to do with a compilers affinity for working in powers of 2's and the cost of the division instruction. A good read on this can be found at: http://blog.dkbza.org/2007/09/reverse-engineering-compiler-produced.html A good reference on these operations can be found at: https://flaviojslab.blogspot.com/2008/02/integer-division.html #2 - Using an unnecessarily large buffer 00401472 8b4508 mov eax, dword [ebp+0x8 {pass}] 00401475 890424 mov dword [esp {var_6c_1}], eax 00401478 e88b270000 call strlen 0040147d 8945ec mov dword [ebp-0x14 {var_18}], eax 00401480 8b45ec mov eax, dword [ebp-0x14 {var_18}] 00401483 c1e002 shl eax, 0x2 00401486 890424 mov dword [esp {var_6c_2}], eax 00401489 e8da270000 call malloc // make the hashed password buffer 4x bigger The above code shows that the program gets the length of the password. We then allocate memory to that length shifted left 2 times. At first I wasn't sure of the purpose of why the developer did this until the end of the hashing function. 0040149a mov eax, dword [ebp-0xc {i}] 0040149d lea edx, [eax*4] // store i * 4, aka i shifted left by 0x2 004014a4 mov eax, dword [ebp-0x18 {offsets}] 004014a7 lea ebx, [edx+eax] // ebx now holds offsets[i*4] 004014aa call rand 004014af mov ecx, eax 004014b1 mov edx, 0x66666667 004014b6 mov eax, ecx 004014b8 imul edx 004014ba sar edx, 0x2 004014bd mov eax, ecx 004014bf sar eax, 0x1f 004014c2 sub edx, eax 004014c4 mov eax, edx 004014c6 shl eax, 0x2 004014c9 add eax, edx 004014cb add eax, eax 004014cd sub ecx, eax 004014cf mov edx, ecx 004014d1 mov dword [ebx], edx // store the current offset at offsets[i*4] 004014d3 add dword [ebp-0xc {i}], 0x1 I believe the reason for this is just throw a bit of confusion to the reverser. This way there will be 4 junk bytes between each hash offset in memory and will no longer be contiguous in memory. Conclusion: Other than those two things it just has a bit of math for the hashing function to get the offsets. I hope this read helps you :)

2021-05-10 05:39

crackmes.one

Latest Solutions