| GO GO GO - Harmful Logic |
VeiledRE |
Nice Golang crackme introduction! |
2021-06-14 11:13 |
View |
| Save Scooby |
Darky |
Simple Keygen.
---
Instructions:
1. Place in the directory with 'save_scooby'
2. Run |
2021-06-10 14:37 |
View |
| Another KeygenMe |
aolvos |
finally i did it! write_up + keygen inside! |
2021-06-09 10:31 |
View |
| hitme,loopme,revme |
Exp0x8zf |
Keygen in Python and a Simple solution |
2021-06-09 03:36 |
View |
| Simple Crack Me |
azukame |
Easy solution with a .txt file and pictures. |
2021-06-07 16:24 |
View |
| First Program |
azukame |
A text & picture solution which easily shows how to solve this crackme. |
2021-06-07 16:00 |
View |
| kgenme1.0 |
dev0 |
Write up with a C source keygen |
2021-06-06 22:56 |
View |
| KeygenMe |
bmdyy |
Python3 script which works for names which are 4 letters long.
Nice easy challenge, thanks! |
2021-06-04 20:38 |
View |
| EZwan2 |
drkmp |
radare2 solution, using the ESIL emulator |
2021-05-31 15:52 |
View |
| EZ crackme |
vulf |
This is my first writeup and this was a fun solve. |
2021-05-30 20:24 |
View |
| SanSuu |
pranav |
Not comprehensive as usual, as there are other solutions available. |
2021-05-29 17:05 |
View |
| spank me v1 |
pranav |
Very good crackme enjoyed it |
2021-05-29 10:43 |
View |
| Pass generator |
mstik13 |
this binary, is most like password generator, but i reversed and created a program that generate the key, same way is generated in the binary |
2021-05-24 03:54 |
View |
| ZED-Crackme |
D4RKFL0W |
Really good crackme. Was a lot of fun. |
2021-05-23 13:43 |
View |
| EZwan2 |
lemma |
you see that cmp s[i], key[i]? set your breakpoint and let the chars come to you. ty Dirk. |
2021-05-22 21:36 |
View |
| SanSuu |
Aodrulez |
This was a fun challenge. Submitting keygen (in python) as solution. |
2021-05-21 21:31 |
View |
| Guess The Password |
dev0 |
Write up with a C solution |
2021-05-21 02:16 |
View |
| CrackThis |
dev0 |
Simple write up and password generator C source file |
2021-05-20 00:34 |
View |
| CrackThis |
MrEmpy |
In this Write Up I used the x32dbg tool to crack the program |
2021-05-17 19:05 |
View |
| SAFE_01 |
MrEmpy |
In this Write Up I used the ILSpy Tool to find out the combination of the safe. Along with Write Up I added the file in .cs and some screenshots to accompany them. |
2021-05-17 18:19 |
View |
| KeygenMe |
dev0 |
Write up and a keygen C source file. |
2021-05-16 05:14 |
View |
| EZwan |
lxeiqr |
The "key" was extracted from a constant variable in the program, while the magic 0x30 number was extracted from a variable, that the main loop buffer overflows into. These have to be processed (each char has to be XORed with 0x55) and then you get the final key. |
2021-05-12 20:41 |
View |
| very easy hardcoded |
Ajakko |
Simple string comparison: 123QWERTY123
Tried strings (command), CutterRE and didn't work; dnSpy saved me. :P |
2021-05-12 18:25 |
View |
| Find the pass |
lfanew |
Program takes a string from user, hashes value and compares to the expected hash at 00405064 - "pcx|xpzlhgu}"
Two things stood out to me in this challenge.
#1 - The compiler optimization for division.
004014b1 ba67666666 mov edx, 0x66666667
004014b6 89c8 mov eax, ecx
004014b8 f7ea imul edx
004014ba c1fa02 sar edx, 0x2
The above code is equivalent to simply dividing edx by 10, or (edx / 10).
The reason for this has to do with a compilers affinity for working in powers of 2's and the cost of the division instruction.
A good read on this can be found at: http://blog.dkbza.org/2007/09/reverse-engineering-compiler-produced.html
A good reference on these operations can be found at: https://flaviojslab.blogspot.com/2008/02/integer-division.html
#2 - Using an unnecessarily large buffer
00401472 8b4508 mov eax, dword [ebp+0x8 {pass}]
00401475 890424 mov dword [esp {var_6c_1}], eax
00401478 e88b270000 call strlen
0040147d 8945ec mov dword [ebp-0x14 {var_18}], eax
00401480 8b45ec mov eax, dword [ebp-0x14 {var_18}]
00401483 c1e002 shl eax, 0x2
00401486 890424 mov dword [esp {var_6c_2}], eax
00401489 e8da270000 call malloc // make the hashed password buffer 4x bigger
The above code shows that the program gets the length of the password. We then allocate memory to that length shifted left 2 times.
At first I wasn't sure of the purpose of why the developer did this until the end of the hashing function.
0040149a mov eax, dword [ebp-0xc {i}]
0040149d lea edx, [eax*4] // store i * 4, aka i shifted left by 0x2
004014a4 mov eax, dword [ebp-0x18 {offsets}]
004014a7 lea ebx, [edx+eax] // ebx now holds offsets[i*4]
004014aa call rand
004014af mov ecx, eax
004014b1 mov edx, 0x66666667
004014b6 mov eax, ecx
004014b8 imul edx
004014ba sar edx, 0x2
004014bd mov eax, ecx
004014bf sar eax, 0x1f
004014c2 sub edx, eax
004014c4 mov eax, edx
004014c6 shl eax, 0x2
004014c9 add eax, edx
004014cb add eax, eax
004014cd sub ecx, eax
004014cf mov edx, ecx
004014d1 mov dword [ebx], edx // store the current offset at offsets[i*4]
004014d3 add dword [ebp-0xc {i}], 0x1
I believe the reason for this is just throw a bit of confusion to the reverser.
This way there will be 4 junk bytes between each hash offset in memory and will no longer be contiguous in memory.
Conclusion: Other than those two things it just has a bit of math for the hashing function to get the offsets. I hope this read helps you :)
|
2021-05-10 05:39 |
View |
| Easy Crackme |
DirkD |
I had fun with this quick easy challenge , i used ollydebug 1.10 :)
I've included a pdf writeup with some screenshots. |
2021-05-09 08:57 |
View |
| VERY EASY VERY SIMPLE C CODE |
Ralkey |
my solution to get the password in a .PDF file
with pictures :) |
2021-05-05 16:54 |
View |
| glow wine [keygen practice] |
shaybl569 |
Python simple keygen |
2021-05-05 14:14 |
View |
