| All your security features are not working...
Crackme decides to replace jnz with jz |
==> |
| Passwords: 'letmein', 'aikmnioi'.
Decrypt function: CALL 0x00007FF7EE8C1FB0 |
==> |
| 61 69 6B 6D 6E 69 6F 69 00 00 00 00 00 00 00 00 aikmnioi
|
==> |
| print(f"{(a:=0x1111):04X}-{(b:=0x2222):04X}-{(48879 - (a ^ b)):04X}") |
==> |
| 0000-0000-BEEF |
==> |
| I also noticed that one function decrypts all important strings in your crackme, I recommend using different encryption algorithms |
==> |
| @kwenma, It took 5 minutes for a clean solution, but I took a detailed look at your defense methods, if you take that into account it took 35 minutes, my estimate of your crackme is just above average |
==> |
| Password: thisisaverysecrettest
You have not encrypted the Anti-Debug function, all this protection is broken if you change 00007FF754C04255 | MOV AL, 0x01 to MOV AL, 0x00, it is not hard to find the place where the password is decrypted by the function graph.
All the best, it was interesting to solve your crackme, keep making them!
|
==> |
| thisisverysecret |
==> |
| 00000022F15EF658 61 64 6D 69 6E 00 00 00 00 00 00 00 00 00 00 00 admin...........
00000022F15EF668 05 00 00 00 00 00 00 00 0F 00 00 00 00 00 00 00 ................
00000022F15EF678 70 61 73 73 77 6F 72 64 00 00 00 00 00 00 00 00 password........
Login: 'admin'
Password: 'password' |
==> |
| 00007FF7AF821450 | E8 4BFEFFFF | CALL | Login loader
00007FF7AF82145E | E8 3DFEFFFF | CALL | Password loader
Just ser breakpoint to the address 00007FF7AF821455 - Login in the RAX and
00007FF7AF821463- Password in the RAX.
Login: 'admin'
Password '12345' |
==> |
| Password: CANTCRACKME
Just set a breakpoint on intermodule calls on "MessageBoxA" and enter a random password, go to the address and we will see:
00007FF662F51323| CMP BYTE PTR DS:[RCX + RAX], 0| rcx+rax*1:"CANTCRACKME" |
==> |
| 0000000BD20FFAD0 63 72 61 63 6B 6D 65 59 47 00 00 00 00 00 00 00 crackmeYG
|
==> |
| Password: '73293729427hdskhdjsk247084379382737wuqowq'
Just set a breakpoint on the address '00007FF75A8B18AA' and we will see
RBX:0000028973C4DDC0"qwoquw737283973480742ksjdhksdh"
RCX:0000028973C45FF0"73293729427hdskhdjsk247084379382737wuqowq" |
==> |