Score:
Number of crackmes:
Number of writeups:
Comments:
| Name | Author | Language | Arch | Difficulty | Quality | Platform | Date | Downloads | Writeups | Comments |
|---|---|---|---|---|---|---|---|---|---|---|
| LvArshu (Flag) | arshi | C/C++ | x86-64 | 3.0 | 4.0 | Windows | 2026-10-14 21:02 | 5 | 0 | 0 |
| Crackme | Date | Infos | Actions |
|---|---|---|---|
| Fugsv1.1 | 2026-09-29 15:44 | Comprehensive Writeup | View |
| Next generation Keygen | 2026-09-29 10:06 | Comprehensive Writeup | View |
| Fugs | 2026-09-24 10:16 | Unpacked 3-layer Python loader (b85+xor+zlib+marshal, custom FC18 codec+HMAC pages, sm_xor) to FUGS-obfuscated crackme, ignored decoy hash check, inverted per-byte transform (95x256 brute force) to re | View |
| Crackme | Difficulty | Points | Date |
|---|---|---|---|
| King of Asgard | 3.0 | 300 | 2026-10-14 21:11 |
| AegisShield | 4.96 | 496 | 2026-10-13 06:44 |
| stckwzrd | 3.0 | 300 | 2026-10-13 06:24 |
| My Third Crackme (Medium + Flag) | 2.5 | 250 | 2026-10-10 04:11 |
| My First Crackme (Very Easy) | 1.0 | 100 | 2026-10-08 14:07 |
| My Second Crackme (Easy + Flag) | 2.0 | 200 | 2026-10-08 14:06 |
| binsafe | 5.0 | 500 | 2026-10-06 04:45 |
| BabyDotNet | 1.0 | 100 | 2026-10-06 04:05 |
| LeetObfuscator Crackme | 4.5 | 450 | 2026-09-29 08:16 |
| Basics::AHardcodedKeyGoneWrong | 6.0 | 600 | 2026-09-26 18:39 |
| study get PASSWORD | 4.0 | 400 | 2026-09-26 17:41 |
| trust me this is really easy :) | 1.0 | 100 | 2026-09-24 14:40 |
| Orbit Fold | 2.0 | 200 | 2026-09-24 14:36 |
| Crackme | Comment | Date |
|---|---|---|
| Orrery 2 | [Click to reveal]./orrery2-linux arshi W0ZKN-C6GA4-53P0W system charted - ORRERY2{ADDACF5A} | 2026-10-04 16:40 |
| Simulation password | [Click to reveal]40 bytes stored in pass.bin Hex: 3fca41c623655bf8173b2a652d656bdf69ca5da43f654665b1e35a6569657e65df8fd265b83b8315 Congratulations, you have beaten the crackme! :) | 2026-10-04 05:07 |
| Loggin | [Click to reveal]Simple 32-bit hash with xorshift to validate the username, then checks the combined password and username hash. Because of hash collisions, many credential combinations can work. | 2026-10-03 03:29 |
| alpmira | [Click to reveal]7h3_r4t_1s_th3_4rch1t3ct_&_th3_n3st_1s_w4rm_~4lw4y5~ | 2026-10-01 09:30 |
| Mini LLM Sentinel | [Click to reveal]AI-60h08e4ne8z9! AI-4q7574tcd86h! AI-7c276r42nr4h! AI-1p7774ce1x5m! AI-x122e029oz2e! AI-1q2ng30i348y! AI-j1y2w524el31! AI-kn355c50k87u! AI-4zl4zy8zyz1v! AI-497879516975! AI-11111111111r! AI-38lQ]4ub&7m3! AI-5KjPidq96769! AI-042]6%5.=960! | 2026-10-01 06:09 |
| SP network cipher | [Click to reveal]import sys;M=2**64-1;A=0x61C8864680B583EB;B=0xBF58476D1CE4E5B9;T=bytes.fromhex("eeb3909781dbdfafc2c5") def S(K,n): c=K&M;p=[] for _ in range(4):a=c%n;v=(c//n-A)&M;b=v%n;c=(B*v+1)&M;p+=[(a,b)] return p def E(K,n): d=[0,0,0];a=K&M;k=[] for _ in range(n): d[0]+=1 if d[0]>3:d[0],d[1]=0,d[1]+1 if d[1]>3:d[1],d[2]=0,d[2]+1 if d[2]>3:d[2],d[1]=0,d[1]+1 a=(a+sum(d))&M;k+=[a&255] return k def F(s,K): n=len(s);a=[*s] for i,j in S(K,n): if i-j:a[i],a[j]=a[j],a[i] l=K&255;h=K>>8&255^90 if l-h:a=[h if x==l else x for x in a] return bytes(x^y for x,y in zip(a,E(K,n))) def G(K): n=len(T);k=E(K,n);s=bytes(c^d for c,d in zip(T,k));l=K&255;h=K>>8&255^90 if l-h:s=bytes(l if x==h else x for x in s) a=[*s] for i,j in S(K,n)[::-1]:a[i],a[j]=a[j],a[i] assert F(bytes(a),K)==T;return bytes(a) if __name__=="__main__":K=int(sys.argv[1])if len(sys.argv)>1 else 43444956;sys.stdout.buffer.write(G(K)+b"\n") | 2026-10-01 05:30 |
| Matryoshka VM | [Click to reveal]> echo "WL7s3EU9i!bN!264!5qhx_3q" | crackme.exe Enter password: [+] Correct! All five virtual machines agree. You found the password. | 2026-09-30 05:31 |
| thefirsttest | [Click to reveal]1923855305 | 2026-09-30 04:44 |
| Automata Simulation | [Click to reveal]"nier". No hash though — nothing multiplies by 13, it just checks the four letters one at a time, any case. The documented patch gets the pods working but you still can't win: the ending is behind a flag nothing ever sets, and that flag is also what stops enemies spawning, so the field never clears. Pointed it at the flag your key sets instead — ends in ~3 seconds. "NierSecretChallenge" class name. Loved it. Good one. | 2026-09-29 19:28 |
| polynomial-crack | [Click to reveal]aboba hackers_password rtURgX6doA00GAkxlptIL2YbpwqsCteJ2 KnTUFtk JIYIvaPEvvnaLXVNMREs OXngfI51SUf5HCTJ Y9 7n5Xxt8yz902OhBywJayJUfOFJskSZoERBmifSM2db qipEKig4eK5IT 8 iK2 | 2026-09-29 16:47 |
| Fugsv1.1 | @Leotrungkien thank you :) | 2026-09-29 10:07 |
| Inside the Machine | [Click to reveal]PS> echo "V1rtu4lM4ch1n3_1ns4n3_2026" | .\crackme.exe ================================================= VM Crackme - custom virtual machine Goal: find the password. ================================================= Enter password: [+] Correct! The machine accepted your password. EXITCODE=0 | 2026-09-29 06:48 |
| reaper maze | [Click to reveal]R7v!K2m#Q9z@ | 2026-09-29 06:47 |
| Fugsv1.1 | [Click to reveal]@@___BRO__VERY__Handsome__@@0X000000000123AASSSDKJDJD@(@+#-#&#&#&!*!*:'')@)@)0101)@/@/)#)#)))/))@(@(@@++(LOVE YOU))))..)@)@)@))@)@)@)@ | 2026-09-29 06:43 |
| Fugsv1.1 | [Click to reveal]====================================================================== FugsHunter Crack v1.01 - Good luck. ====================================================================== Guess the flag: @@___BRO__VERY__Handsome__@@0X000000000123AASSSDKJDJD@(@+#-#&#&#&!*!*:'')@)@)0101)@/@/)#)#)))/))@(@(@@++(LOVE YOU))))..)@)@)@))@)@)@)@ CORRECT!!🥰 | 2026-09-29 06:38 |
| Key | $ python keygen.py; "exit code: $LASTEXITCODE" test -> AAg->_:-1 verify=True fern -> AAg->_:-1 verify=True crackme -> AB6->_:-1 verify=True arshi -> AKy->_:-1 verify=True abcd -> AAg->_:-1 verify=True 0123456789abcdef -> ACO->_:-1 verify=True exit code: 0 | 2026-09-29 06:32 |
| Needle in a Haystack | [Click to reveal]kafkaesque_99 | 2026-09-29 06:04 |
| Embrace RSA | import hashlib,sys N=26496633762146499818860157002479052785659218298910846353636500220736231412584690289692744501740342807358419171842903405070650989567788641540165117027624320225446933431225525511492285704023402535919310959719360794704009709525500262891058503799496169869483101509242346719726416741871217047836570293584493819103414069216264429488563508552791368747404063573415512785968533726657435476727701944811983631450302904441386850741255186991265107621306375445936649071960768667376357094970090371446120123120541367583390506188146662593620959699733016715285538286615648530228310868951704708669286053275142959175387360446674197678933 D=0xC7E9393830E73D37B1C6D84DB03B4C75E4324CD7FE3854231FA41F6E2D4F4552DA263FC8FC136FA310C104A17C300FB0CB2C90B26D9558F637F2624D67118070FCF8B649694E625627A75ED811B36EB09376B498652F1206FD8F7F108F66ADF9F69BC029F1525021B788C5442B2834F75315821C51F3213BEBD05A1E623DF8B39A2BF6DB55103BE429145C0957958EF5828F770170F07DD04FA9402E965E0B056A01B379C2A55B3AA0C2CA05BA8EE9C060227A909A80D3EDBBD2EFE230FF1F7B6B684712C28A4E147D2F0D17679B36B6237855627BCE84992A11FBB42BC24206B5522A58248D120FFD0F0B721FF5F605E4779771818C1777824DBBF2BD15C681 u=sys.argv[1].strip() m=int.from_bytes(hashlib.sha256(u.encode()).digest(),"big") print(format(pow(m,D,N),"x")) | 2026-09-28 06:44 |
| Cortisol level low keygen | [Click to reveal]W=[1,3,7,9,1,3,7,9,1,3];k=lambda n:n+str((-(sum(int(c)*w for c,w in zip(n,W)))%10+10)%10);print(k("1234567890")) → 12345678903 → Ok, Ok you are not that dumb. :3 Full SHA256: 102cd396a16bb1aced9c4a768dfc93ea7de44509b53e8ee2d8699b33b1f42aca | 2026-09-27 18:46 |
| Cortisol level low keygen | W=[1,3,7,9,1,3,7,9,1,3];k=lambda n:n+str((-(sum(int(c)*w for c,w in zip(n,W)))%10+10)%10);print(k("1234567890")) → 12345678903 → Ok, Ok you are not that dumb. :3 Full SHA256: 102cd396a16bb1aced9c4a768dfc93ea7de44509b53e8ee2d8699b33b1f42aca | 2026-09-27 18:46 |
| ComputeTheKey | [Click to reveal]I started by triaging the target as a stripped 14528-byte PIE ELF64 x86-64 executable dynamically linked against libc (SHA-256 e30c8719bd92272bd817de64a0567067755f6eaeac337000e5f36cc6e14980f9, full RELRO, NX stack, no canary, .text only 0x337 bytes), and the tiny import table — just puts, strlen, memcmp, __printf_chk and __libc_start_main — immediately told me there was no scanf/fgets, so the key had to arrive as argv[1]. From _start's lea rdi,[rip+0x263] before the call to __libc_start_main I recovered that main lives at 0x1342, and the strings Usage: %s key, Incorrect key! and Correct key! at 0x2004/0x2013/0x2022 gave me the success and failure branches. The first gate was a simple length check — cmp rdx,[0x4020] with the qword 0x14 stored there means strlen(key)+1 must equal 20, pinning the key at exactly 19 characters — and the real puzzle sat in the instructions right after it, where main computes a djb2 hash (seed 0x1505, h = h*33 + c, helper at 0x1312) over its own code bytes in the range 0x1342..0x13e5 and stores only the low byte into keystream slot 0 at 0x4018, meaning the byte sitting in .data there is a deliberate decoy and the real first keystream byte only exists at runtime. The transform routine at 0x11c3 then splits the 19 payload bytes into blocks of (19-1)/3 = 6 (via a 64-bit div by the qword 3 at 0x4010) and applies a self-inverse rotating XOR using xor_block at 0x11a9: s[0..5] ^= ks[0], s[6..11] ^= ks[1], s[12..17] ^= ks[2], and s[18] ^= ks[0] in the tail loop at 0x1236, after which the sete byte ptr [rax] at 0x12e4 rewrites the string's NUL terminator to 0x01 — which explains why the reference buffer stored at 0x4030 ends in 01. With the effective keystream computed as fd c0 de and the stored ciphertext being a5 a2 ae b8 be af 85 94 9f 8b 85 99 81 86 81 ef ed ee ca 01, the final check is a single memcmp(argv[1], 0x4030, 20) at 0x13ce, so because XOR is its own inverse there was no search whatsoever — simply plain[i] = cipher[i] ^ ks[(i/6) % 3] yields the key X_SECRET_KEY_X_1307, and I confirmed it by executing a byte-for-byte copy of the untouched original (still SHA-256 e30c8719bd92272bd817de64a0567067755f6eaeac337000e5f36cc6e14980f9), which printed Correct key! and exited 0 with no patching, no forced branches, and no modification to the binary. | 2026-09-27 18:17 |
| Spaghetti Keygen | @TeRrArIsT It's not a problem with your skill the only actual check is 12th (0x2f92), all of the others always return 1. It doesn't carry out an xor operation on the letters. For each character c: ebx = ((c ^ (c+2)) * 0x4D2) % 0x8D eax = mt19937_64_output(state after feeding c) pass if ebx == eax For example, 'P'=0x50. (80^82)=2. 2*1234%141=71. MT also gives 71. So P*8..123 passes. The funcs which are labelled as "empty" are merely noise produced by libstdc++: 0x41FC stands for nop, 0x4063 for return 0, 0x420C for return arg, 0x4134 for *iter, 0x4110 for ++iter, 0x40D0 for iter!=, and 0x42EE/0x439E/0x4624/0x4742 are used for mt seed/gen/twist. You should ignore these and instead hook only the begin and end functions whilst emulating 0x2f92 in this way you'll obtain (71,71) as the result for P. | 2026-09-27 16:04 |
| Spaghetti Keygen | import random print("P"*random.randint(8,123)) | 2026-09-27 16:02 |
| Orrery | [Click to reveal]The orrery (keygenme by SVz) has been solved. On day 20686 (ORRERY_DAY), when the name "CrackMe" is used, the serial number generated is TWCB-TC6H; executing the command `orrery.exe CrackMe TWCB-TC6H` causes the program to output "system charted - ORRERY{8407B3CC}" (with an exit status of 0). The method used was to realise that the 32 border probes (those that are absorbed, reflected or deflected) are merely echoes from a 10x10 board — if a probe goes straight it is absorbed by the cell in front of it, otherwise the two diagonal cells determine what happens: if both do, the probe is reflected; if one does, it makes a 45-degree mirror bounce; if neither does, the probe goes straight; the day only selects which of the 32 echo bytes to read from a pre-existing 3653x32 table in the .rdata section, so I reversed the physics, searched through the C(64,5)=7,624,512 different five-planet combinations (including 2 sound prunes, with a unique result each time), and packed the five winning cells as 5x6 bits, XORed with a 30-bit FNV-1a hash of the name after it has been trimmed and converted to uppercase, plus a 10-bit FNV checksum, resulting in 8 base32 characters; the ORRERY{...} fingerprint is only calculated after a successful replay has taken place, so it is impossible to forge it by means of a forced branch, and my keygen correctly predicted the value 8407B3CC before the binary was run — 156 name/day pairs were accepted with matching fingerprints, the binary was never modified, the SHA256 hash of orrery.exe is B98A16BC879F602672C7B7C5A64E0AA4A4C9824BC9D1DFFBE6BEE0C95AC669AD, and orrery E7B111C058E66F86321B7CE75B2C1C8EF414F2989C40DF970A9AE47621541006. | 2026-09-27 14:24 |
| CrackmesForBeginners (CFB) #9 | [Click to reveal]The exe had no security logic at all. It just looked for a validator.dll that wasn't shipped, loaded it from its own folder, and trusted whatever VerifyLicense returned. That's the whole crackme. No packing, no anti-debug, no delay-loads. IDA decompiled main() in one shot and the entire access check was a single instruction: cmp eax, 0x1337C0DE. That number is just the author's signature "leet" in hex. Nothing else in the program ever looks at what you typed. So the whole solve was writing a 40-line DLL that exports one function returning that number, dropping it next to the untouched exe, and running it. ACCESS GRANTED, first try. No patching, no breakpoints, no iteration. The title gives it away: the easiest way to break a lock is to replace the guard. The exe trusted a file from its own directory with zero verification that's the real bug, not the missing DLL. | 2026-09-27 03:59 |
| CrackMe - v1.0.0 | zl7HjNJzlDH7oygG | 2026-09-26 21:41 |
| Simple Frog | @victormeloasm #!/usr/bin/env python3 # simplefrog keygen -> python3 keygen.py [name] (WSL/Linux + X; needs simplefrog next to this script) import os,sys,time,ctypes,hashlib,struct,shutil,select,errno M,C1,C2,V=(1<<64)-1,0xBF58476D1CE4E5B9,0x94D049BB133111EB,0xEE18D70B34696718 SRC=os.path.join(os.path.dirname(os.path.abspath(__file__)),"simplefrog");DST="/tmp/simplefrog" def R(x,r):x&=M;r&=63;return x if r==0 else((x<<r)|(x>>(64-r)))&M def gen(n,ts,w,h): v=0x14650FB0739D0383 for b in n:v=(0x100000001B3*(b^v))&M t=(C1*(v^(v>>30)))&M;t=(C2*(t^(t>>27)))&M;k=t^(t>>31);w,h,ts=w&0xFFFFFFFF,h&0xFFFFFFFF,ts&M a=R(ts,17)^((w<<32)&M)^h^V^R(k,31);s=(R(V,29)+R(ts,43)+k+0x53696D706C654672)&M;i,j,g,d=5,9,0,0 for _ in range(16): e=(a+R(s,i))&M;f=((0xD1342543DE82EF95*e)&M)^s;x=(g^e)&M;u=(C1*(x^(x>>30)))&M;c=(C2*(u^(u>>27)))&M a,s=c^(c>>31),R(f,j);d=s;i+=7;j+=11;g=(g+0x9E3779B97F4A7C15)&M return hashlib.sha256(n+b"\0"+struct.pack("<QQIIQQ",V,ts,w,h,a&M,d&M)).hexdigest() def dims(): x=ctypes.CDLL("libX11.so.6");x.XOpenDisplay.restype=ctypes.c_void_p;x.XOpenDisplay.argtypes=[ctypes.c_char_p];p=x.XOpenDisplay(None) for f,t in(("XDefaultScreen",ctypes.c_int),("XRootWindow",ctypes.c_ulong),("XDisplayWidth",ctypes.c_int),("XDisplayHeight",ctypes.c_int)):getattr(x,f).restype=t s=x.XDefaultScreen(p);rt=x.XRootWindow(p,s);w,h=x.XDisplayWidth(p,s),x.XDisplayHeight(p,s) try: r=ctypes.CDLL("libXrandr.so.2");r.XRRGetMonitors.restype=ctypes.c_void_p;r.XRRGetMonitors.argtypes=[ctypes.c_void_p,ctypes.c_ulong,ctypes.c_int,ctypes.POINTER(ctypes.c_int)];n=ctypes.c_int(0);m=r.XRRGetMonitors(p,rt,1,ctypes.byref(n)) if m and n.value>0: for i in range(n.value): G=lambda o:ctypes.cast(m+i*56+o,ctypes.POINTER(ctypes.c_int)).contents.value if G(20)<=0<G(20)+G(28)and G(24)<=0<G(24)+G(32):w,h=G(28),G(32);break r.XRRFreeMonitors.argtypes=[ctypes.c_void_p];r.XRRFreeMonitors(m) except OSError:pass return w,h def sec():# fail only clock_gettime(CLOCK_MONOTONIC) -> binary's fixed-entropy branch class F(ctypes.Structure):_fields_=[("c",ctypes.c_uint16),("t",ctypes.c_uint8),("f",ctypes.c_uint8),("k",ctypes.c_uint32)] class P(ctypes.Structure):_fields_=[("l",ctypes.c_uint16),("f",ctypes.POINTER(F))] p=[F(0x20,0,0,4),F(0x15,0,5,0xC000003E),F(0x20,0,0,0),F(0x15,0,3,228),F(0x20,0,0,16),F(0x15,0,1,1),F(6,0,0,0x50000|errno.EPERM),F(6,0,0,0x7FFF0000)] a=(F*8)(*p);q=P(8,a);l=ctypes.CDLL(None) if l.prctl(38,1,0,0,0)or l.prctl(22,2,ctypes.byref(q),0,0):os._exit(111) def go(n,w,h): ir,iw=os.pipe();orr,ow=os.pipe();pid=os.fork() if pid==0: os.dup2(ir,0);os.dup2(ow,1);os.dup2(ow,2) for fd in(ir,iw,orr,ow):os.close(fd) sec();os.execve(DST,[DST],os.environ);os._exit(127) os.close(ir);os.close(ow) def W(tag,b=8.0): d=b"";end=time.time()+b while tag not in d and time.time()<end: if not select.select([orr],[],[],max(0,end-time.time()))[0]:break c=os.read(orr,4096) if not c:break d+=c return d W(b"Name: ");fr=time.time()%1.0 if fr>0.3:time.sleep(1.05-fr) t0=time.time();os.write(iw,n+b"\n");W(b"Serial: ");t1=time.time();ok=s=None if int(t0)==int(t1): s=gen(n,int(t0),w,h);os.write(iw,s.encode()+b"\n");ok=b"Croak! Correct serial."in W(b"\n",6.0) else: try:os.write(iw,b"0"*64+b"\n") except OSError:pass os.close(iw);os.close(orr) try:os.waitpid(pid,0) except OSError:pass return ok,s def main(): shutil.copy(SRC,DST);os.chmod(DST,0o755);os.environ.setdefault("DISPLAY",":0") n=(sys.argv[1] if len(sys.argv)>1 else"frog").encode()[:127];w,h=dims();print(f"[*] name={n.decode('latin1')!r} dims={w}x{h}") for i in range(1,101): ok,s=go(n,w,h) if ok:print(f"[+] serial: {s}\n[+] Croak! Correct serial. (attempt {i})");return 0 print("[-] gave up");return 1 sys.exit(main()) | 2026-09-25 09:02 |
| Simple Frog | Serial = SHA256(name + monotonic/mouse entropy + wall-clock sec + screen dims), so it changes every run. Raw syscalls, so no LD_PRELOAD faketime. Escape hatch in main: if (clock_gettime(CLOCK_MONOTONIC,&t) < 0) { v26 = 0xEE18D70B34696718; ptr=(0,0); } If that read fails, the whole timing/mouse loop is skipped → entropy becomes a constant and pointer=(0,0) forces the deterministic screen-dims branch. Can't patch/hook/inject the binary — so I filtered it at the kernel: seccomp-BPF returning EPERM only for clock_gettime(CLOCK_MONOTONIC), CLOCK_REALTIME allowed. fork → install filter → execve the untouched ELF (filter inherited). Now everything's deterministic. Reimplemented the math (FNV → splitmix64 → 16-round mixer → SHA-256), read monitor size via Xrandr, used the current second, fed the serial back same-second. Croak! Correct serial. | 2026-09-24 16:45 |
| Crackme C++ | virtualized & packed | [Click to reveal]S3cr3tP@ss | 2026-09-24 16:09 |
| Wheredakey | [Click to reveal]BashQc3fZ16AjD701x0O | 2026-09-24 14:32 |
| Fugs | [Click to reveal]My friend is really crazy haha_000XXX1101010999999998888999999__FUCKYOU____LOVEYOU_😁😁😁 | 2026-09-24 10:09 |