| /\ Hydra \/ (MCM 7) /\ |
@beto2dev Incredible work on the analysis! Reversing the VM, the 48-round shuffle, and building the Unicorn emulator is top-tier stuff!;) Your math with GF(65537) is really impressive, but as you noted in section 12, your 1024-byte collision contains null bytes and whitespace. The real binary (cin >>) cuts it off after 3 bytes and prints ACCESS DENIED. You crafted your own flag for the offline emulator, but the original password is a clean, printable ASCII string (and much shorter than 1024 bytes!!!)
You are definitely the closest anyone has ever been to solving Hydra. Keep digging for the real key ;))
|
2026-09-14 11:13 |
| /\ Hydra \/ (MCM 7) /\ |
@tenzo_aoki I think this crackme so hard for peoples)
|
2026-06-25 10:23 |
| /\ Hydra \/ (MCM 7) /\ |
somebody have progress?
|
2026-06-11 22:05 |
| CrackmesForBeginners (CFB) #5 |
@crackalove you can reverse pass but you need to REAL understand programm logic.
But okay)
|
2026-05-31 22:02 |
| [FIXED] Observer's Paradox |
@KasperskyLabsEngineer nice work, upload a writeup ;)
I will be recommended to you my crackme "MCM 7". If you have time - check mcm7, I think It's so interesting challenge ;)
|
2026-05-18 11:16 |
| [FIXED] Observer's Paradox |
@KasperskyLabsEngineer ??? Wdym serial and keys? I think you commented wrong crackme…
|
2026-05-18 08:30 |
| /\ Hydra \/ (MCM 7) /\ |
@SmallXGen nice work! Goodluck
|
2026-05-15 18:37 |
| /\ Hydra \/ (MCM 7) /\ |
???
|
2026-05-04 09:58 |
| Willy Wonka's Chocolate Factory |
@jia ;)
|
2026-04-22 09:05 |
| MCM 6.0 - Project Mayhem |
@a.v.e.r I check your writeup! Excellent work! See you on MCM 7;)
MCM 6 - OFFICIALY SOLVED BY @a.v.e.r
|
2026-04-20 13:12 |
| MCM 6.0 - Project Mayhem |
@a.v.e.r Nice. Im gonna check It tomorrow. Do you wanna try MCM7?
|
2026-04-20 09:25 |
| /\ Hydra \/ (MCM 7) /\ |
have progress guys ?
|
2026-04-18 11:23 |
| MCM 6.0 - Project Mayhem |
@a.v.e.r Hello! Try to check MCM 7(hydra) I think It's more interesting than MCM6.. And easier than MCM6....
|
2026-04-18 10:41 |
| /\ Hydra \/ (MCM 7) /\ |
@zhi_ thanks
|
2026-04-07 09:03 |
| Willy Wonka's Chocolate Factory |
@xzrka thanks for good words;)
|
2026-04-04 11:40 |
| MCM 6.0 - Project Mayhem |
@a.v.e.r good luck with brute;)) I'm updated the MCM6 rules, you can check again It on desc;)
|
2026-03-31 11:11 |
| MCM 6.0 - Project Mayhem |
[Click to reveal]@notpanda sorry man but you find a decoys. And sometimes “success” you getting “verify complete” It’s just a troll decoy.. Look at comments here and you will understand all situation
|
2026-03-21 07:11 |
| Willy Wonka's Chocolate Factory |
@inbadtrip and @msym
Nice guys! Make a writeups ;)
|
2026-03-17 21:48 |
| MCM 6.0 - Project Mayhem |
[Click to reveal]@a.v.e.r I see you've finally moved past the decoys that caught everyone else. "color (6-1)*2" - I like that one. You've clearly identified where the real logic starts.
You're doing great, probably the closest anyone has ever been to solving this. Looking forward to seeing your full write-up once you get the final key. Good luck with the final step
|
2026-03-17 19:31 |
| custom vm crack me :) |
pass: Hi_U_Cracked_Me
Found LCG XOR loop in main (seed 76, k = (109*k+79)|1).
Decoded v31/v32 constants to get the key: Hi_U_Cracked_Me.
Validation happens inside the VM routine at sub_7FF6F33A2210.
Message: CORRECT!!
I think It's a joke crackme but why not =_=
|
2026-03-16 14:22 |
| MCM 6.0 - Project Mayhem |
@a.v.e.r I checked the code and confirmed my words 100%. The string you found isn't the key. That "Success" output was just a decoy trap; because you were flagged and the keys were already corrupted, the text ended up garbled. Everything happened exactly as I thought.
|
2026-03-14 22:14 |
| MCM 6.0 - Project Mayhem |
@a.v.e.r The decryption keys likely broke early on. That "Success" output was just a decoy, but since the keys were already corrupted, the text ended up garbled. Basically, the app flagged you and corrupted the keys early. There's a 95% chance this is the case. To be 100% sure and give you a better answer, I'd need to check the code, as the architecture is pretty complex with tons of protections. But yeah, it's most likely exactly what I wrote above.
|
2026-03-14 21:46 |
| MCM 6.0 - Project Mayhem |
@a.v.e.r nah, key is wrong..
|
2026-03-14 21:32 |
| MCM 6.0 - Project Mayhem |
@arasreal Hi arasreal! Nice try with unpacking the loader, but you didn't actually crack the CrackMe.
Everything you described in your write-up (the 2MB Control Flow Flattening, FNV-1a hashing, anti-debug, Fisher-Yates + XOR decryption) is just the auto-generated unpacking process of my custom packer. You successfully bypassed the packer, but you completely missed the actual challenge.
After dumping the internal executable, you just ran a strings search over the `.rdata` section. The "passwords" you found (`PwEedPasswordOtsosiPenis`, `S4CaqeCret20MCM6`, `0xCC010558193FUNC1337`, etc.) are blatant honeypots (decoys) that I deliberately put there to bait people who just search for plaintext strings without analyzing the core logic.
The real core logic is entirely different, much more complex, and untouched in your analysis. Since the challenge remains 100% unsolved and the provided solution is just a list of decoy strings, I have contacted the Review Team to request the removal of this invalid write-up. Better luck next time!
|
2026-03-11 06:49 |
| MCM 6.0 - Project Mayhem |
10.03.2026 still not cracked
|
2026-03-10 18:04 |
| MCM 6.0 - Project Mayhem |
[Click to reveal]@a.v.e.r Spot on. You found how some pieces connect together early on. But that's just the outer shell. The real nightmare hasn't even started for you yet ;)) . Good luck with the core!
|
2026-03-09 11:38 |
| MCM 6.0 - Project Mayhem |
[Click to reveal]@a.v.e.r Good job getting the dump! The environment variables and memory manipulations are definitely part of the architecture. You've uncovered the outer shell, but you're right - the real logic is buried deep under the obfuscation. Good luck finding the core
|
2026-03-09 09:44 |
| MCM 6.0 - Project Mayhem |
have progress guys ?
|
2026-03-08 20:50 |
| MCM 6.0 - Project Mayhem |
@AI Nice try, but your theory is 100% wrong. 😂
Both of those "tokens" are absolutely incorrect. There are no intermediate or resolved tokens here. The "runtime-dependent logic" you noticed is just the program intentionally feeding you randomized troll responses, fake flags, and fake delays whenever you enter a wrong password. You completely fell for the traps! Good luck finding the real path.
|
2026-03-07 22:31 |
| MCM 6.0 - Project Mayhem |
@dumspirospera he did't cracked It. Im contacted with him
|
2026-03-07 19:37 |
| MCM 6.0 - Project Mayhem |
@clutchy my discord is pwn.by
|
2026-03-07 13:27 |
| MCM 6.0 - Project Mayhem |
@clutchy Oh okay, do you wanna contact discord with me? It's really interesting how you did that
|
2026-03-06 15:56 |
| MCM 6.0 - Project Mayhem |
@clutchy make a writeup ;)
|
2026-03-06 15:31 |
| MCM 3.0 REWORK |
@clutchy make a writeup and go to MCM 6.0 :)
|
2026-03-06 14:18 |
| MCM 6.0 - Project Mayhem |
@dumspirospera sry I dont wanna hit your ego. Because It's real not "Easy" for "Beginners"
|
2026-03-05 19:34 |
| MCM 6.0 - Project Mayhem |
@dumspirospera try to solve something easier, I think It's to hard for beginners yk
|
2026-03-05 15:47 |
| Unbreakable Python? My Custom Obfuscation Engine |
Layer 1 and 2 Extracted a Base64 and Zlib encoded payload that launches a hidden daemon thread named saadjqymaqfc to run all protections in the background.
Layer 3 and 4 Chaos VM and Hardware Fingerprint Found Anti-VM checks scanning for MAC addresses like 080027, 000569, 000c29, 001c14, 005056. Extracted the author's target machine SHA256 hardware fingerprint: 90178d2d1e81e3cc1373ae36327277909ea0a904108c26fb80fec88755553bbd which binds to WMI disk, BIOS, and CPU serials. Extracted the Chaos algorithm math logic which uses 50 iterations of the logistic map: 3.99 * val * (1.0 - val). Recovered the final derived Master Key: 64322080736143896125652295414509504119508758357723799657495947910577489034260
Layer 3 Cryptography Found the core payload hidden in a massive Base85 string. Bypassed the decrypter which uses large integer modular exponentiation (pow function) and a custom XOR routine disguised as addition and subtraction math.
Layer 6 Integrity Self-Check Extracted the expected SHA256 checksum of the unmodified file: 9de1a7e0b2d79d9be0d1f5b71bee50ce2656856c4b78f05c60d4ad242b0eaf0c
Layer 7 Bytecode Obfuscation and Payload Extracted the final hidden function named: smooth_rgb_normal_text Discovered the obfuscator spoofed the bytecode argument count to 0 to crash debuggers, when it actually requires 4 arguments. Extracted the final hardcoded variables for the effect: text is noname, spacing 1, speed 0.1, wave_width 0.5, and sine wave RGB multipliers using 127, 128, 2, and 4. Identified the intentional silent anti-analysis tactic relying on compiled Python 3.10 bytecode opcodes that intentionally segfault newer Python versions like 3.13 if not cleanly extracted.
|
2026-02-24 19:02 |
| MCM 2.0 |
@nightxyz yep it works but not original pass
|
2026-02-14 23:43 |
| MCM 2.0 |
@savasciasi pass is wrong try again btw
|
2026-02-14 19:38 |