Score:
Number of crackmes:
Number of writeups:
Comments:
| Crackme | Date | Infos | Actions |
|---|---|---|---|
| Tenzo Crack ME Beta | 2026-09-10 13:01 | Brute-force | View |
| The Rabbit Hole | 2026-08-29 12:02 | Nice original one | View |
| Evaisve | 2026-08-06 14:23 | Static unpacking: the binary is a reflective PE loader that LZMA-decompresses its real payload from an FPACK resource. | View |
| Crackme | Difficulty | Points | Date |
|---|---|---|---|
| LeetObfuscator Crackme | 4.5 | 450 | 2026-09-26 07:58 |
| study get PASSWORD | 4.0 | 400 | 2026-09-26 05:33 |
| Basics::AHardcodedKeyGoneWrong | 6.0 | 600 | 2026-09-25 07:33 |
| trust me this is really easy :) | 1.0 | 100 | 2026-09-22 18:19 |
| Orbit Fold | 2.0 | 200 | 2026-09-22 07:00 |
| Crackme | Comment | Date |
|---|---|---|
| Automata Simulation | [Click to reveal]NIER + 0x140001a64 c6 05 7d 96 00 00 01 mov byte [rel 0x14000b0e8], 1 0x140001a6b 90 x 16 nop (16 octets) | 2026-09-30 08:32 |
| Quintessence | [Click to reveal]Name : svz Serial : 15FE-EC09-4E3B-3B26 Correct! Serial accepted for this name. Proof token: 5200257236783E1D | 2026-09-23 16:35 |
| LATTICE4 | [Click to reveal] +--------------------------+ | LATTICE-4 | | ................ | +--------------------------+ L4tT1cE4Gf256Z3x [ OK ] flag{GF256_lattice_beats_hand_math} | 2026-09-22 12:11 |
| Secret Menu | [Click to reveal]p = [193, 222, 216, 223, 202, 216, 194, 198, 219, 199, 206, 211, 196, 217] def decode(): text = '' for i in p: text += chr(i ^ 171) return text 'justasimplexor' | 2026-09-19 15:47 |
| sygil.fun | [Click to reveal]#!/usr/bin/env python3 """ Computes the "sigil" expected by the sygil crackme for a given name. Algorithm extracted from sub_401690 (Binary Ninja): hash = 0x811C9DC5 # FNV-1a offset basis for each byte c of `name` (until '\n' or end of string): hash = ((hash ^ c) * 0x01000193) & 0xFFFFFFFF # FNV-1a prime if the process is traced (ptrace detected via /proc/self/status): hash ^= 0xDEADBEEF a = hash ^ 0x5947494C b = (hash >> 16) ^ (hash & 0xFFFF) # movzx edx, dx before the xor: 16-bit fold c = a ^ b ^ 0x535947 sigil = f"syg-{a:08x}-{b:04x}-{c:08x}" Detail confirmed from the disassembly (not just the pseudo-C): - `movsx eax, byte [rdi]`: each byte of name is read SIGNED (sign-extend), not zero-extended, before the xor/imul. - `movzx edx, dx` right before `xor ecx, edx`: b is actually a XOR between the high word and the low word of hash, not (hash>>16) ^ hash over 32 bits. """ import argparse FNV_OFFSET = 0x811C9DC5 FNV_PRIME = 0x01000193 MASK32 = 0xFFFFFFFF def _signed_byte_as_32(c: int) -> int: """Reproduces movsx eax, byte[rdi]: sign-extends byte c to 32 bits.""" if c < 0x80: return c return 0xFFFFFF00 | c def sygil_hash(name: str, traced: bool = False) -> int: h = FNV_OFFSET for c in name.encode(): if c == 0x0A: # '\n' break h = ((h ^ _signed_byte_as_32(c)) * FNV_PRIME) & MASK32 if traced: h ^= 0xDEADBEEF return h & MASK32 def compute_sigil(name: str, traced: bool = False) -> str: h = sygil_hash(name, traced) a = (h ^ 0x5947494C) & MASK32 b = ((h >> 16) ^ (h & 0xFFFF)) & MASK32 c = (a ^ b ^ 0x535947) & MASK32 return f"syg-{a:08x}-{b:04x}-{c:08x}" def main(): parser = argparse.ArgumentParser(description="Computes the expected sigil for a given name (sygil crackme)") parser.add_argument("name", help="value to enter at the 'name: ' prompt") parser.add_argument("--traced", action="store_true", help="simulate the case where the binary detects a tracer (anti-debug active)") args = parser.parse_args() if len(args.name) <= 3: parser.error("the binary requires strlen(name) > 3") sigil = compute_sigil(args.name, traced=args.traced) print(f"name : {args.name}") print(f"sigil: {sigil}") if __name__ == "__main__": main() | 2026-09-16 16:17 |
| zW0rM | [Click to reveal]Funny, get at Score = 5 ;) Z+{SOm3_T1Mes_Y0u_N33dToEn_joyTheGameT0Crack_it} | 2026-09-15 08:11 |
| ZSecure | Very funny, thanks | 2026-09-14 07:37 |
| Tenzo Crack ME Beta | [Click to reveal]T3nz0-VM-2026-V1rtu4l-Unl0ck3d!! | 2026-09-09 09:18 |
| echo_labyrinth | [Click to reveal]r3flect with Z3 solver | 2026-09-06 08:53 |
| TermBreaker | [Click to reveal]SILKWORM for exemple, the hardest part was getting the binary to run in a VM (QT 6.11). | 2026-09-04 15:25 |
| crackme_l6_hard | [Click to reveal]'gamers' seems to be the winner | 2026-09-03 09:23 |
| Figger | [Click to reveal]All 30s : key = 0x57984997 for i = 0 to 7 : d = (seed / (i + 1)) % 251 key = (key * 131 + d + i*7) % 0x7FFFFFFF return key | 2026-08-31 13:51 |
| VBO-Vanguard: ARM64 Virtual Machine & ARX Challenge | [Click to reveal]BruteForce a2 : bool sub_100000FAC(uint16_t a1, uint16_t a2, uint16_t a3, uint16_t a4) { // (a4 >> 11) | (32 * a4) == ROL16(a4, 5) -- rotation gauche de 5 bits, écrite en MBA uint16_t rot_a4 = (uint16_t)((a4 >> 11) | (a4 << 5)); bool c1 = (uint16_t)(a2 ^ a1) == 0xE123; bool c2 = (uint16_t)(rot_a4 ^ a3) == 0x80CB; bool c3 = (uint16_t)(a2 + a1 + a3 + a4) == 37203; bool c4 = (uint16_t)(a3 - 25033 * a2) == 59538; return c1 && c2 && c3 && c4; } 5 candidates. FLAG-7a3f-9b1c-4d8e-2e6a ========================================================================= REVERSE ENGINEERING CRACKME CHALLENGE ========================================================================= [+] SUCCESS! KEY VALIDATED (Token: 0x7A3F9B1C4D8E2E6A) [+] FLAG{VBO_VIRTUAL_MACHINE_CRACKME_SOLVED_2026} ========================================================================= | 2026-08-28 12:25 |
| Easy_Get | [Click to reveal]85437A25DCF156E51B5487F9510F425E6D2C63A418931049565392F34D900299 | 2026-08-26 18:06 |
| sob Obfuscator Challenge (insane++) | [Click to reveal]ITSDmco-JDspfloasd-d1843jdsy38 | 2026-08-26 08:51 |
| Orrery | Nice writeups @Mr64, @nke (crackme inspired by BlackBox game). Solution identifiee : jour : 20689 (2026-08-24) planetes : [(1, 1), (4, 1), (2, 4), (5, 4), (4, 5)] sel : 0x33146161 nom : 'Sir Isaac Newton' serial : SHKX-J2DS % python3 ./tools/identify.py "ORRERY{460B9E7E}" --name "sawyer" Solution identifiee : jour : 20689 (2026-08-24) planetes : [(1, 1), (4, 1), (2, 4), (5, 4), (4, 5)] sel : 0x13A16A62 nom : 'sawyer' serial : 9TSZ-A10A | 2026-08-25 13:32 |
| NinthCircle | [Click to reveal]operator> SVZREVERSER serial> BE7E5206-612A150D-DDC34AAA-6810CB61 | 2026-08-17 15:50 |
| Extreme key validator | [Click to reveal]N0VAX-7C4DE-Q9R2K | 2026-08-17 07:35 |
| Very simple but obfuscated crackme | Yeah, clearly impossible via static analysis. A lead using a length-based oracle: by counting executed blocks (qemu-x86_64 -d │ exec,nochain) for inputs between 1 and 40 characters, a massive spike appears at n=7 (+1300 blocks vs the ~30 trend) → password length = │ 7. | 2026-08-16 13:13 |
| Very simple but obfuscated crackme | [Click to reveal]password = Its_Me! flag = LEET_FLAG{Whos_A_Good_Boy?} | 2026-08-16 09:14 |
| FREEDOM Crackme | [Click to reveal]Username: svz_reverser Serial : 0000B8A32E4AEF6F | 2026-08-11 13:09 |
| Maze by LvHa | Resolving maze was fun :) (easy version ;) | 2026-08-11 07:31 |
| Maze by LvHa | [Click to reveal]LvHa{LvHa-bin2bin-vm} | 2026-08-10 20:25 |
| Abyss Crackme v1 | [Click to reveal]forgot the flag : abyss{good_boys_pay_the_ferryman} | 2026-08-10 11:47 |
| Abyss Crackme v1 | [Click to reveal]SVz : 5598-C6A7-DD9C-AD9A | 2026-08-10 07:50 |
| ShouldBeNormal | [Click to reveal]transrights | 2026-08-08 13:19 |
| ShouldBeNormal | [Click to reveal]ShouldTox+M | 2026-08-08 13:04 |
| Evaisve | [Click to reveal]Sometimes we have to suffer | 2026-08-06 13:30 |
| learning_vm | [Click to reveal]Amazing! I got this ;) | 2026-07-31 12:11 |