| BobxREAL V3 Final Version |
@Baranqqqs Correct! |
2026-02-28 00:02 |
| BobxReal You Can't do it V2 ;) |
@Biglsim04 @msym @vbu @OB_BUFF
Thanks for all the feedback!
I took everything into account – the VM bug, weak anti-debug, predictable seed, etc. – and built a completely new version (V3).
VM now actually transforms input (no more random "Correct!")
Anti-debug is state‑based and corrupts the key on detection
Strong seed with RDTSC + CryptGenRandom
No global round table – rounds are generated on‑the‑fly
Watchdog monitors integrity |
2026-02-25 13:42 |
| BobxReal You Can't do it V2 ;) |
@vbu You're right, my bad! I owe you an apology - after checking the code again, I realized the VM has a serious bug that causes it to accept multiple passwords instead of just one. The fake flag "BOBXFRCRACKXD" was just a decoy, and "FLAG{BOBXCRACK00" coincidentally works because of the VM flaw, but it's not the actual intended password.
The real password should be derived from EXPECTED_FIXED XOR g_vm_key, but thanks to the VM bug, pretty much any 16-char string works. So technically the crackme is broken, not solved.
I'll release a fixed version soon. Thanks for exposing the issue! |
2026-02-22 17:07 |
| BobxReal You Can't do it V2 ;) |
@vbu Nice try, but "FLAG{BOBXCRACK00" is just one of the fake flags I left in the binary to mislead reversers. The real password is 16 characters and doesn't follow the FLAG{} format. Keep digging! |
2026-02-22 17:02 |
| BobxReal You Can't do it V2 ;) |
@Biglsim04 Yes, there is an actual password The algorithm does real transformations (or at least it was supposed to - the VM bug broke it). The math operations aren't just for show they're meant to modify your input in specific ways. If you go deeper you'll see the expected values are derived from fixed constants XORed with a runtime key. The challenge is to reverse those operations Thanks for giving it another look |
2026-02-21 22:41 |
| BobxReal You Can't do it V2 ;) |
Thanks for the feedback! Patching isn't solving - anyone can patch, but the actual password hasn't been found yet. You're right about the VM bug, multiple strings work because the VM generates rounds but doesn't apply them to input. Good catch! Anti-debug is too simple indeed. v3.0 coming soon with proper VM transformation and state-based anti-debug. Thanks for helping me improve! |
2026-02-21 18:40 |
| VeryHard 99% you can't do it |
that version was quick, I'm preparing something better for you ;) |
2026-02-20 21:27 |
| Very hard antidebug +10 antisystem |
Okay, I'm preparing version v2, which is not so easy anymore |
2025-11-09 00:33 |
| Very hard antidebug +10 antisystem |
thanks for using the bug to correct it |
2025-11-08 10:08 |
| Tiempo Oculto |
ASOC{l4_cl4v3_3st4_3n_3l_c0d1g0} |
2025-11-05 22:20 |