| Custom Packer + Nested-VM Crackme (x64) — 8/10 |
@ArasElmas don't bother attempting this as long as the author does not confirm that a valid password actually exists and is reachable in practice, rather than a brute-force target with 2⁵⁶+ possibilities that would take years to search. (a 10-round custom ARX/indexed transform over a 32-byte state must equal a hardcoded 32-byte table. Only the first 30 input bytes enter the state. The check does not short-circuit — it OR-accumulates all 32 byte differences — so there is no timing or positional oracle) Cube-and-conquer partitions return neither SAT nor UNSAT because each cube still covers ~2⁴⁶ candidates.
|
2026-09-15 15:02 |
| Custom Packer + Nested-VM Crackme (x64) — 8/10 |
[Click to reveal]- stage-zero unpacker and manual mapper
- the whole anti-debug and integrity architecture, including the detection-as-key-corruption design
- .smc decrypted, with the verdict equation and both messages recovered offline
- the VM lifted to a disassembler, a CFG, an SSA IR, and the full ten-round algebra
- an emulator now verified against the real instruction stream. But now just a boring expensive preimage attack on a custom 10-round ARX construction. So what the point ? does it satisfiable by some input ?
|
2026-09-15 14:10 |
| TryBypassMe Kernel Edition |
Amazing, thank you @DeadEye707. I created an article https://www.fl0sec.com/research/kernel-anti-cheat-ctf since it have have a lot of checks and ways to do it wihtout even needing kernel-mode access.
|
2026-09-14 09:29 |