| crackme6 by detten |
Valid PASS: Omelllllln
Serial can be 0, this because Ome decodes the program to jmp to the mov [bytesuccess],1 and the llllln is because it satisfies this: bool __cdecl sub_40116F(int a1)
{
int v1; // eax
int v2; // ecx
v1 = 0;
v2 = 0;
while ( *(_BYTE *)(a1 + v1) )
v2 += *(char *)(a1 + v1++) / 2;
return v2 == dword_40A0E8(0x20A);
}
|
2026-08-14 14:37 |
| Pandora VM |
@4epuxa did you make it using LLVM? its really impressive, or what method did you use? it executes 4 millions instruction lol
|
2026-08-03 13:55 |
| SlimKeyGen |
@deleted_user your solution is not accepted by me, you merely pasted what ai told you, and even used same variable names as xusheng solution, shame on you
|
2026-07-26 12:22 |
| SlimKeyGen |
I dont want a writeup to make you feel good if you have no idea what you are doing and just use AI and not even TEST IT AT LEAST ON REAL PROGRAM, and even your AI got it wrong, i know this is a bit harsh, but you honestly deserve it
|
2026-07-25 19:51 |
| SlimKeyGen |
No pleasw dont make a writeup, you cannot solve and need to fully use AI so no need for it, so it was you who gave like 1 of rating?
|
2026-07-25 19:46 |
| SlimKeyGen |
Did you just patch the code to print access granted? Anyway if it is your first day go with 1 of difficulty or 2 max for now, this one is pretty hard
|
2026-07-25 12:56 |
| SlimKeyGen |
This is NOT a crackme you should do at all, use easy crackmes until you got some skills and then go on harder crackmes...you dont need to patch anything, did you read the description?? Also dont make writeups if you are so confused
|
2026-07-25 12:52 |
| SlimKeyGen |
So I cannot trust any future solution to be made from scratch😂
|
2026-07-25 07:55 |
| SlimKeyGen |
Well now that xusheng provided a perfect solution(even if using ai) it is correct and explained exactly how it is, so if you are stuck you can look at that solution
|
2026-07-25 07:54 |
| Pandora VM |
mmm this is assemlby not c++ 100%, those things can only be written in asm
|
2026-04-03 13:24 |
| niko's vm final!! :) |
[Click to reveal]VM DISPATCHER IS AT 0x3EA0
|
2026-04-02 15:53 |
| niko's vm final!! :) |
[Click to reveal]The exact comparison of character per caracter happens at 0x6092, i broke down all VM handlers which are these: .rdata:000000000000E320 funcs_140004731 dq offset LoadImmHandler32_4D30
.rdata:000000000000E320 ; DATA XREF: sub_3B10+16↑r
.rdata:000000000000E320 ; VMDispatcher_3EA0+34↑o ...
.rdata:000000000000E328 dq offset AddHandler_4E10
.rdata:000000000000E330 dq offset SubHandler_4E70
.rdata:000000000000E338 dq offset MultiplicationHandler_4ED0
.rdata:000000000000E340 dq offset DivisionHandler_4F30
.rdata:000000000000E348 dq offset DIVMODHAndler_4FB0
.rdata:000000000000E350 dq offset XorHandler_5030
.rdata:000000000000E358 dq offset AndHandler_5090
.rdata:000000000000E360 dq offset OrHandler_50F0
.rdata:000000000000E368 dq offset NotHandler_5150
.rdata:000000000000E370 dq offset ShiftLeftHandler_5180
.rdata:000000000000E378 dq offset ShiftRightHandler_51E0
.rdata:000000000000E380 dq offset MovHandler_4DB0
.rdata:000000000000E388 dq offset CMP_EQ_5240
.rdata:000000000000E390 dq offset JmpHandler_52A0
.rdata:000000000000E398 dq offset JmpIfFlag_52E0
.rdata:000000000000E3A0 dq offset JNZ_5320
.rdata:000000000000E3A8 dq offset PUSHIMM_5360
.rdata:000000000000E3B0 dq offset POP_IMM_53B0
.rdata:000000000000E3B8 dq offset Call_5410
.rdata:000000000000E3C0 dq offset Ret_5470
.rdata:000000000000E3C8 dq offset _guard_check_icall_nop
.rdata:000000000000E3D0 dq offset PrintReg_54C0
.rdata:000000000000E3D8 dq offset PRINT_VM_55C0
.rdata:000000000000E3E0 dq offset ApiDispatcher_5870
.rdata:000000000000E3E8 dq offset sub_5890
.rdata:000000000000E3F0 dq offset MemcpyVM_5A10
.rdata:000000000000E3F8 dq offset VMERROR_54B0
.rdata:000000000000E400 dq offset StackChyper_5B00
.rdata:000000000000E408 dq offset ReadInputVM_5B40
.rdata:000000000000E410 dq offset RealCheckPasswordVM_5DA0
.rdata:000000000000E418 dq offset sub_5B20 but the only necessary is the RealCheckPasswordVM: and the password is: HELLO! - HELLO! - I HOPE YOU ENJOY THIS CRACK ME IT TOOK ME A WHILE - !@#$%^&*()_+-=, just put a bp on that address and annotate on notepad, could be better but its not that bad
|
2026-04-02 15:44 |
| BobxReal You Can't do it V2 ;) |
[Click to reveal]👍is there an actual password or is it like that we need to salve an alghoritm? Because I saw you did tons of matematic operations, thanks, maybe tomorrow ill go a bit deeper
|
2026-02-21 18:53 |
| BobxReal You Can't do it V2 ;) |
[Click to reveal] if ( KILL_30B61 || KILL_30B60 && (v32 = NtCurrentPeb()) != 0LL && v32->BeingDebugged || sub_15E0() || sub_1A00() ) example of what i mean, this is too easy to understand
|
2026-02-21 18:24 |
| BobxReal You Can't do it V2 ;) |
[Click to reveal]It is't too hard to understand what the program is doing also the anti debug is pretty easy to understand, also the checks with an if is too weak, you should make it state dependent, meaning for example the program automatically breaks if something changes. you could have added Hash checks to prevent software bp and also hardware bp by for example occupying them and using them as state,good one anyway
|
2026-02-21 18:22 |
| BobxReal You Can't do it V2 ;) |
[Click to reveal]Since the author didn't specify i patched and now the program prints "correct!"
|
2026-02-21 18:17 |
| puzzle |
Good job and stay tuned for a really hard challenge next time, cause i f up haha
|
2025-11-21 11:15 |
| puzzle |
And how did you do it? I already know the mistake but still at least i learned from it
|
2025-11-20 21:32 |
| puzzle |
Yes i made a mistake i will fix in the next... what message you got on the console?
|
2025-11-20 21:21 |
| puzzle |
The password of the zip is still crackmes.one
|
2025-11-20 19:51 |
| puzzle |
I just noticed i made some mistakes that could have been avoided but that will be for the next version🥲
|
2025-11-20 19:32 |