Score:
Number of crackmes:
Number of writeups:
Comments:
| Name | Author | Language | Arch | Difficulty | Quality | Platform | Date | Downloads | Writeups | Comments |
|---|---|---|---|---|---|---|---|---|---|---|
| arshi #1 | arshi | C/C++ | x86-64 | 6.0 | 6.0 | Windows | 2026-10-20 11:19 | 245 | 1 | 11 |
| LvArshu (Flag) | arshi | C/C++ | x86-64 | 3.0 | 5.0 | Windows | 2026-10-14 21:02 | 670 | 0 | 0 |
| Crackme | Date | Infos | Actions |
|---|---|---|---|
| Fugsv1.1 | 2026-09-29 15:44 | Comprehensive Writeup | View |
| Next generation Keygen | 2026-09-29 10:06 | Comprehensive Writeup | View |
| Fugs | 2026-09-24 10:16 | Unpacked 3-layer Python loader (b85+xor+zlib+marshal, custom FC18 codec+HMAC pages, sm_xor) to FUGS-obfuscated crackme, ignored decoy hash check, inverted per-byte transform (95x256 brute force) to re | View |
| Crackme | Difficulty | Points | Date |
|---|---|---|---|
| STILL Crackme | 5.0 | 500 | 2026-11-02 19:51 |
| mothlight | 2.0 | 200 | 2026-10-31 04:49 |
| Obfuscated password | 6.0 | 600 | 2026-10-29 22:39 |
| Zatryoshka | 2.0 | 200 | 2026-10-29 03:37 |
| my first password crackme | 1.0 | 100 | 2026-10-28 03:39 |
| VSEC - Pafet Crackme | 6.0 | 600 | 2026-10-26 07:56 |
| Tetris DRM | 6.0 | 600 | 2026-10-24 18:34 |
| VSEC Challenger Num #8 | 6.0 | 600 | 2026-10-24 08:10 |
| Functions! | 2.0 | 200 | 2026-10-20 04:06 |
| The Winner | 4.5 | 450 | 2026-10-20 04:06 |
| VSEC Challenger Num #4 | 6.0 | 600 | 2026-10-20 04:06 |
| VSEC Challenger Num #1 | 4.96 | 496 | 2026-10-18 13:17 |
| binsafe | 5.0 | 500 | 2026-10-18 11:41 |
| VSEC Challenger Num #2 | 5.0 | 500 | 2026-10-15 10:37 |
| Schizo | 3.0 | 300 | 2026-10-15 10:30 |
| King of Asgard | 3.0 | 300 | 2026-10-14 21:11 |
| AegisShield | 4.96 | 496 | 2026-10-13 06:44 |
| stckwzrd | 3.0 | 300 | 2026-10-13 06:24 |
| My Third Crackme (Medium + Flag) | 2.5 | 250 | 2026-10-10 04:11 |
| My First Crackme (Very Easy) | 1.0 | 100 | 2026-10-08 14:07 |
| My Second Crackme (Easy + Flag) | 2.0 | 200 | 2026-10-08 14:06 |
| binsafe | 5.0 | 500 | 2026-10-06 04:45 |
| BabyDotNet | 1.0 | 100 | 2026-10-06 04:05 |
| LeetObfuscator Crackme | 4.5 | 450 | 2026-09-29 08:16 |
| Basics::AHardcodedKeyGoneWrong | 6.0 | 600 | 2026-09-26 18:39 |
| study get PASSWORD | 4.0 | 400 | 2026-09-26 17:41 |
| trust me this is really easy :) | 1.0 | 100 | 2026-09-24 14:40 |
| Orbit Fold | 2.0 | 200 | 2026-09-24 14:36 |
| Crackme | Comment | Date |
|---|---|---|
| dc540-0x0000a | @kevinthomas Fair point 0xDE5E2C19 was from my static table notes, not the UART! Mapped the control plane on 4242 -> 0x2000A000 (PID 999) down to 0x2000C000 [serpent:secrets] in SRAM. Enjoy the pacing, I'll be watching when the throat opens. | 2026-11-03 16:12 |
| dc540-0x0000a | [Click to reveal]@kevinthomas Lore Drop 1 ("The Ash Word"), decoded Fragment 1, authenticated Gate 1 (0xDE5E2C19), and unsealed Sanctum Layer 1 / Chapter 2 ("the subconscious"). Standing by at Gate 2 for the next two words. | 2026-11-03 13:58 |
| dc540-0x0000a | @kevinthomas anything new | 2026-11-03 04:35 |
| dc540-0x0000a | @kevinthomas Could you please post an update here when the words start dropping? I’ll keep the verified pipeline ready and resume as soon as you post. | 2026-11-01 16:15 |
| dc540-0x0000a | @kevinthomas I’ve decrypted the accessible records, reproduced the KDF/ChaCha path, and confirmed the three 71-byte fragment gates and 215-byte final-key layout. I’ve also located the first badge’s published story, but no candidate has authenticated yet. By ‘first word,’ do you mean Fragment 1’s opening word, directly present in that story? | 2026-11-01 14:58 |
| dc540-0x0000a | @kevinthomas The binary only gives the flag prefix, the full flag requires three 71 byte fragments and the first seems to require external Stage One/badge data. Can you confirm if another artifact or the physical badge is needed? I'm asking for the point to start, not the answer. | 2026-11-01 12:57 |
| dc540-0x0000a | [Click to reveal]FLAG: {th3_s3rp3nt_sl33ps_n0_m0r3} | 2026-10-31 18:41 |
| Froggate III: Requiem for the Old Order | [Click to reveal]$ python3 keygen.py === Froggate III: Requiem for the Old Order — Standalone Keygen & Verifier === Target binary : froggate-iii (1,331,440 B, sha256=e66025325749b321e640d276a6301cff8feed15a200be0ca6626240957849065) Stage-2 plugin : f3_plugin.so (307,216 B, sha256=437405544fef9bf05f8d06cb15f82176eaf7376872b2975e474db981a5bab193) F3CORE02 blob : 13,245 B (sha256=be2fbf7c4dca463512dc9aaba2ebf27b93ec2e20eb7bfe31e41a4075ffe5cd27) [1/5] Verifying F3MINRANK 1 witness (q=251, m=8, n=8, r=2, t=28) & HNP-CHAIN commitments... Witness x = [109, 0, 9, 82, 106, 188, 191, 216, 247, 91, 178, 50, 29, 235, 54, 135, 155, 83, 212, 170, 206, 49, 230, 202, 228, 97, 88, 61] HINT_COMMIT = c47c377934df96f08d6f5b812e1c3479...2744efefc022a587 (MATCH) HINT_PROOF = faf166ed5bd977d78e5151405846e41f...a45113c746963aab (MATCH) [2/5] Unsealing HINT_CIPHER via HKDF-SHA512 + RFC 8452 AES-256-GCM-SIV (192-byte AAD)... HKDF key = a58e05044fc9c8c909d9b34e224315b2660f9a03b8df06bc63fa3dd5bde6b030 Plaintext = header 'F3HNP02\x00\x1c\x0b' + 28x 11-bit MSB hints: [1733, 658, 1210, 1153, 1084, 752, 728, 1637] ... [3/5] Solving 30-dimensional secp256k1 Hidden Number Problem via LLL (delta=0.99)... ECC_PUB = 03EB607E66168E86D772AE6DCBDE800CC858FED89954F0C0E79692D2B35DF91992 Recovered d = 0x3614d2061c0283375a295fd23646b02e5892ffbfcb6a63c87d95a58dce77605d (3.01s, all 28 ECDSA nonces verified) [4/5] Synthesizing 3-part serials (ECDSA + 274-round F3MRZK02 + BIP0340 Schnorr)... CHALLENGE=85f123ad17c0820054db015cb28d1db4 -> 204,410 chars (0.29s) CHALLENGE=a794a15fef1c3990d6676f5c3cf86dc3 -> 207,398 chars (0.29s) CHALLENGE=53e39914d75b9daeb2276473895cc802 -> 199,718 chars (0.35s) Sample Serial Breakdown (for CHALLENGE=85f123ad17c0820054db015cb28d1db4, saved to sample_serial.txt): Part 1 [ECDSA r||s, 128 hex] : 6c4d90ddf1a17f6a8e338cb93752d63a7f016a13c6a2a27f7639d5c55d19767355192d57d04482233303d0fa5df66e0c8d13623106b295cc8f34b9085b30d206 Part 2 [F3MRZK02, 204,152 B64] : RjNNUlpLMDISAcYaM0S9G9GFiLlkYJ+/pET9KiUR+6Yw...LcbYziNJqHa8DyzCfHzC8HvjlSLvao8HyYCjyuBonK7u (binary=153,114 B, rounds=274, sha3_512=9b3f5160d1a79b658eccb24a09acd961...) Part 3 [BIP0340 Pok, 128 hex] : c77103490b10b68f2ec9be6b3cf559adcf578809b202619e754d70170f52b1f75653a45d4255cb1cfa317e146f8eb186c221d8468a6cc30cdbc82d7f5ec8987f [5/5] Verifying against unmodified f3_plugin.so (`f3_plugin_open` + `f3_plugin_verify`)... f3_plugin_open(F3CORE02, 13245) -> 1 (OK) f3_plugin_verify(CHALLENGE=85f123ad17c0820054db015cb28d1db4, serial[204,410 B]) -> 1 (VALID) f3_plugin_verify(CHALLENGE=a794a15fef1c3990d6676f5c3cf86dc3, serial[207,398 B]) -> 1 (VALID) f3_plugin_verify(CHALLENGE=53e39914d75b9daeb2276473895cc802, serial[199,718 B]) -> 1 (VALID) Tamper checks (wrong_chal=0, flip_ecdsa=0, flip_mrzk=0, flip_schnorr=0) -> all REJECTED (0) [RESULT] ALL CHECKS PASSED — SERIAL VERIFIED `VALID` AGAINST UNMODIFIED BINARY. | 2026-10-31 12:28 |
| c++ keygen crackme | [Click to reveal]python3 /home/user/plikan_keygen/keygen.py \ --role "Kernel Architect" \ --org "CrackmesOne" \ --handle "plikan" \ --cpuid 0xE075C77A \ --ram-mib 16384 # -> Junk-Bytes-9C59EF00-8376A1E1-04352EED-133B9E6C-B2016419-BDD553F3-A5A5906F-A6D8D23D-8357 | 2026-10-30 09:52 |
| VSEC ALPHA-VM CrackMe | [Click to reveal]@VSEC CMO{VSEC_ALPHA_NESTED_VM_DEVIRTUALIZED} This one? | 2026-10-30 09:14 |
| Simple Easy CrackMe (Tutorial Video) | [Click to reveal]AGIGATOR | 2026-10-29 22:42 |
| r00t0 KeygenMe v4 | [Click to reveal]PASS alice -> 4baea03c57a30b182d6bfced205566f3 [OK! Serial code accepted.] PASS r00t0 -> b586a2486ecbf832461dbd9aacc445a7 PASS Bob -> 2527e126e6b0f393309ad3f9e8c75491 PASS crackmes.one -> 00e323edbc1173c4fdb463badb3bea56 PASS zz -> 7afb750cc8a5e5488ab5da2fbebdb21a | 2026-10-28 16:54 |
| first crackme | [Click to reveal]3 u A A G D 7 6 H A Y z p 9 A 1 u B 0 Z Z 9 5 y 0 Z F 2 | 2026-10-28 16:22 |
| Modified Bessel | [Click to reveal]15530825832803\0\0 | 2026-10-28 08:13 |
| Modified Bessel | [Click to reveal]@livlivliv 15530825832803 LoadLibraryA(b'mandel.dll') -> 0x10000000 GetProcAddress(mandel.dll, b'function') -> 0x1000102e GetProcAddress(mandel.dll, b'key') -> 0x10001085 MessageBoxA(text=b"You've solved it!!", caption=b'Congrats') | 2026-10-28 08:12 |
| Python UnpackMe & CrackMe 10/7 (Hard-Level) 3.12 | [Click to reveal]M89309Q7ZVTFK3ERG5NRTE | 2026-10-28 03:39 |
| O! | [Click to reveal]Username: RSTUVWXY Serial: 7776717073727d7c | 2026-10-27 17:54 |
| ARMsRace | [Click to reveal]s3kr3tt0fl4g | 2026-10-26 09:22 |
| Zero³ | @CrackNotMe for now i am sharing the keygen | 2026-10-25 20:48 |
| Zero³ | [Click to reveal]=== ZeroZeroZero | RE-challenge === === Author @pwn.by (905573931098996806) === === My site: https://pwned.space/ === Enter Password: Vfpsh4znJSOOlr2usZK61gsg3tQeR6EMWcCfrRWZFFgKPlsBfWG4N7ar1kIBdzkGlky2Qqb4fuBgnzPdfRyC8FCAPs6MXfXb [+] ACCESS GRANTED. Press any key to exit... | 2026-10-25 20:39 |
| Python OBFVM KryptonV2 | [Click to reveal]KRY{P1P3-ACC3SS} | 2026-10-25 09:07 |
| time based riddle | [Click to reveal]Answers: keyboard map footsteps m Verified flag: FLAG{TIME_TRAVELER} | 2026-10-25 08:44 |
| arshi #1 | @victormeloasm @reagentc @sacredgravel44 @zizomolto and whole crackmes community, I apologise to everyone i didnt knew how this happened you all did a good job this is the flag that is supposed to be recovered at the end arshi{G0d_T13r_VM_N4n0m1t3_GF2_64_M4st3r_R3v3rs3r_2026} I am open the share the source code if you want you can text me on discord ar_ssshi. Again sorry please i never supposed this would turn out like this, sorry for my bad english | 2026-10-25 05:02 |
| Lattice-6 | [Click to reveal]Username: CrackMes1 Valid 44-char Serial: 8YO4cBYeQNL+RPAgxK/sPqc5kd7taPp1u2Et5BYJpeDN Flag: CMO{lattice_lu_gf65537_spn} | 2026-10-25 02:42 |
| Zero4 - He is a very friendly friend! | I was expecting something like total all :) | 2026-10-25 02:41 |
| Zero4 - He is a very friendly friend! | [Click to reveal]Zero3_is_not_malware_please_check_manually_instead_of_auto_CAPE_sandbox [+] ACCESS GRANTED! ---------------------------------------------------------- [CAPE-VM AUTO-MODERATION SIMULATOR]: "Your crackme 'Zero³' has been rejected! Reason: Certified Malware by CAPE-VM. Send it again and you will be banned!" ---------------------------------------------------------- [*] Achievement Unlocked: Survived the Automated Sandbox Apocalypse! [*] Fun fact: When a crackme actually uses heavy anti-analysis (custom packer, nanomites, SMC), automated bots panic and stamp 'Certified Malware' on it. [*] So here is Zero4 instead: 0% packer, 0% nanomites, 1 simple XOR loop, 100% bot-approved :) [*] (All jokes aside, much respect to the crackmes.one community & mods!) | 2026-10-25 02:32 |
| VSEC Challenger Num #6 | @VSEC have you tried solving the binary you uploaded as I don't think it prints any flag also there's multiple bugs in the binary | 2026-10-23 06:40 |
| Exxtruder's VM Keygenme Challenge: 2. Hard VM | [Click to reveal]crackmes ELPLRHOZB3CGIFIC Verified (R_32 == 0 -> 0x121b22) TestUser10 LXT6FBHL4ROATB66 Verified (R_32 == 0 -> 0x121b22) admin KUBT4C4LNN5E5FME Verified (R_32 == 0 -> 0x121b22) | 2026-10-23 05:44 |
| CrackmesForBeginners (CFB) #8 | [Click to reveal][*] Welcome to CFB8 - Concurrently Yours. [*] Initializing quantum threads... [+] Threads initialized and waiting. [*] Enter dynamic session token (32 hex characters): [+] Token: b9cad988a591d5d16347634733333333 [Harness] Extracted live PID & ephemeral TIDs from .data @ 0x140036358: PID = 1895 (0x767) -> key[0] = 0x67 tids[0] = 1903 (0x76f) -> key[1] = 0x6f tids[1] = 1904 (0x770) -> key[2] = 0x70 tids[2] = 1905 (0x771) -> key[3] = 0x71 tids[3] = 1906 (0x772) (unused) Computed 32-hex Session Token: b9cad988a591d5d16347634733333333 [Harness] Post-join state: is_valid = 1, current_step = 4 =================================================== [+] ACCESS GRANTED! Congratulations! You have successfully solved CFB8! =================================================== | 2026-10-22 22:18 |
| Project Debugscura | [Click to reveal]this one is too easy =============================================== Anti-Debug Detection Techniques Test Suite =============================================== PID: 1337 Process Handle: 0x0xffffffffffffffff =============================================== [+] Method 1: IsDebuggerPresent() IsDebuggerPresent returned: 0 [OK] No debugger found. [+] Method 2: CheckRemoteDebuggerPresent() CheckRemoteDebuggerPresent returned: 1 pbDebuggerPresent: 0 [OK] No debugger found. [+] Method 3: NtQueryInformationProcess - ProcessDebugPort (0x7) NTSTATUS: 0x00000000 DebugPort: 0x(nil) [OK] No debugger found. [+] Method 4: NtQueryInformationProcess - ProcessDebugObjectHandle (0x1E) NTSTATUS: 0xC0000353 DebugObject: 0x(nil) [OK] No debugger found (STATUS_PORT_NOT_SET). [+] Method 5: NtQueryInformationProcess - ProcessDebugFlags (0x1F) NTSTATUS: 0x00000000 DebugFlags (NoDebugInherit): 1 [OK] No debugger found (NoDebugInherit = 1). =============================================== RESULTS SUMMARY =============================================== Checks Performed: 5 Debugger Detected: 0/5 checks [OK] STATUS: RUNNING CLEAN (No debugger detected) =============================================== Press any key to exit... | 2026-10-22 22:08 |
| VSEC Challenger Num #6 | @VSEC | 2026-10-22 08:26 |
| VSEC Challenger Num #6 | [Click to reveal]For VSEC #7 I've managed to recover but i am unable to find any flag 32-Byte AES-256 / HMAC-SHA256 Key: dd07fbc199226a8bce8302ce40ce8bf552663d3dcd6453c0665bceac669b8bf5 | 2026-10-22 06:11 |
| arshi #1 | [Click to reveal]@zizomolto yeah please make a writeup | 2026-10-21 17:37 |
| arshi #1 | @reagentc @sacredgravel44 The logic is crackable, but the uploaded build may currently be operationally blocked on some Windows 11 systems. | 2026-10-21 15:14 |
| arshi #1 | @reagentc it is solvable | 2026-10-21 05:53 |
| arshi #1 | @sacredgravel44 no its not win7 only | 2026-10-21 05:51 |
| VSEC Challenger Num #6 | [Click to reveal]Valid Serial: 1337-C0DE-FACE-B00B Flag: CMO{VBDR_#@#DCVB_#$FC_VSEC_V#986569} | 2026-10-21 05:38 |
| CFM #777 — The Stochastic Casino | [Click to reveal]Nice Quarkslab experiment! Dodged oracle.exe (0x14002f710 ^ 0x77), argc > 999, and the 0x140063550 prompt trap; verified 0x140005b50 gives r12 = 0 under explorer.exe (0xc0f80086) + clean .text CRC32 (0x6707a214); and inverted all 77 ARX rounds (0x20..0x26, RC at 0x140063510, S-box ror8(b^0x77,3)+0x33, suffix "_777!\0"). One catch in State 0x30 (0x14000a85c): since you replaced the reel_77[0..6] target comparison with the 64-bit rolling hash rbx (0x9e3779b97f4a7c15 / 0xdeadbeefcafebabe) seeding SplitMix64 over the 613-byte banner at 0x14002f480 ("7-7-7 JACKPOT"), arx_inv has no target reel_77[0..6] to invert from without brute-forcing the 64-bit rbx seed first! | 2026-10-20 14:14 |
| TotalALL | The Last Gate | [Click to reveal]R8vC2mZ7qL4xN9tB6kP3dH5sW1yF0aJ8uE2rG6cM9pT4nV7zX3bQ5cK9m2 | 2026-10-20 14:05 |
| ChronosKeygenme (brainfuck) | [Click to reveal]@victormeloasm The reason it was so quick is that you don't have to bypass the VEH/Watchdog/DRx checks at runtime by attacking it statically: The 427-byte VM bytecode at 0x140004620 is simply XOR'ed with 0xA7 (at 0x1400018a0). All 3D T-boxes at 0x140009740 (initialized at 0x140001710) are just containers for the 256-byte S-box at 0x140004420 plus 16 round constants at 0x140004520, all packed into ((S[(x + rc[r])&0xff]^((rc[r]>>8*j)&0xff))<<8*j) Finally, after lifting the 14 opcodes in the VM dispatcher at 0x140001c70, you can get the hash of the username mixed with the 4-word ARX mixer at 0x1400013c0 + 64-step state mixer, plus the 4 target dwords at 0x140004560, then run through the 16-round 4-branch Feistel network to get the serial (%08X-%08X-%08X-%08X). Inverting the 16 Feistel rounds from r = 15 to 0 gives you a straight keygen. The b58decode in my previous comment was just stuffing the 256-byte S-box (0x140004420) + constants (0x140004520/0x140004560) to fit inside the comment box (still had to cut off the last two lines). | 2026-10-20 07:53 |
| ChronosKeygenme (brainfuck) | [Click to reveal]arshi B91E9406-56576061-0B836CAA-67EC18EA | 2026-10-20 06:13 |
| ChronosKeygenme (brainfuck) | [Click to reveal]from base64 import*;from struct import* *S,p,q,u,w,A,D,a,b,c,d,M=unpack("<256B31I",b85decode("H$Yc@wfs}IDXTx_oo7QbHBNiJ6@UYpMFZ8nxyb7xYsx*uUk=l*ou9Se9d6T1*K{M~x}uw=1$Fw7JNU}5o0zA_`8<*Maru)!`2{0Xm+Vu{S@^4RNir`#VU*V_lMb6Y?68M!WpIze31ZDk--tsH?%w10AzZ5rfe52e9|#8?O_ck34ZnwFRa<kQ-!z*RrAh<NuYO@xU3Q<^C*-r1iIAz*6==;w&1xIplX`Q2p3f6%(Ms2LCFZ-LpR(5uRjwD38M0dz-@dJ`H&lbf6?pA*4Zed~MM6_{dkU>$C;#W->jW)isQ_o-X8@~cH5LmJDOQu>L9{o`h-yD1(+H!5E{YiwM00QhA~*@8&@rDWnEEaViEK{n<{>CWcN5S!&t_D<Yz*l%w<)Z^-B5hVwbg__7YRqTrQ5aX&-=i&kwiCfm@kS#xp_C9q3hXh+`Jo)nR$X*@4hz^9iLhRXXXiNg|272a`SFHI`vPb|NsC0")) R=lambda n,k:n<<k|(n&M)>>32-k for e in map(ord,input().rstrip(" \r\n")):a=R(d,7)+(e*p^a);b=R(a,11)^(e^w)+b;c=R(b,13)+(e+q^c);d=R(c,17)^e*u+d for i in range(64):j=i&3;a,b,c,d=b,c,d,a^R(b,5+4*j)+(i>>2)+S[~j] H=a,b,c,d for i in range(16):t=(sum(S[a>>j&255]< | 2026-10-20 06:09 |
| ChronosKeygenme (brainfuck) | [Click to reveal]too easy | 2026-10-20 05:57 |
| crackme | [Click to reveal]PeNiZoBfUsCaT0R67 | 2026-10-18 18:24 |
| Belle | [Click to reveal]r0cKy=M()unT@in=H!&h | 2026-10-18 14:00 |
| Whale | [Click to reveal]k7N2vXp9Rj4mLtQsB5wzY1gHc | 2026-10-18 13:29 |
| matryoshka9 | [Click to reveal]"xxKG3TxXLUg5cFi26wA9RJcMPhHwlGiIPJpaLh9PUISUlwBbJMaVKfuA2sB3mD3T4NjhTZb8meKM" | .\matryoshka9_cmo.exe enter serial (76 chars, A-Z a-z 0-9): correct | 2026-10-18 05:47 |
| Simple Frog | [Click to reveal]@victormeloasm he deleted that crackme xd | 2026-10-18 05:21 |
| TryDec | [Click to reveal]VOe2HSKgrYEUqGN7CnJlzu9tWIvb0h3wipAQLsxD1Moa5yBmR6f4kFT8cjZPdX | 2026-10-17 09:20 |
| RiJiN crackme | [Click to reveal]LwDYrgFzXpnB87K4tySLZJjyg6tRNFXNfgkFx96yNdBHZqgY | 2026-10-15 15:29 |
| Orrery 2 | [Click to reveal]./orrery2-linux arshi W0ZKN-C6GA4-53P0W system charted - ORRERY2{ADDACF5A} | 2026-10-04 16:40 |
| Simulation password | [Click to reveal]40 bytes stored in pass.bin Hex: 3fca41c623655bf8173b2a652d656bdf69ca5da43f654665b1e35a6569657e65df8fd265b83b8315 Congratulations, you have beaten the crackme! :) | 2026-10-04 05:07 |
| Loggin | [Click to reveal]Simple 32-bit hash with xorshift to validate the username, then checks the combined password and username hash. Because of hash collisions, many credential combinations can work. | 2026-10-03 03:29 |
| alpmira | [Click to reveal]7h3_r4t_1s_th3_4rch1t3ct_&_th3_n3st_1s_w4rm_~4lw4y5~ | 2026-10-01 09:30 |
| Mini LLM Sentinel | [Click to reveal]AI-60h08e4ne8z9! AI-4q7574tcd86h! AI-7c276r42nr4h! AI-1p7774ce1x5m! AI-x122e029oz2e! AI-1q2ng30i348y! AI-j1y2w524el31! AI-kn355c50k87u! AI-4zl4zy8zyz1v! AI-497879516975! AI-11111111111r! AI-38lQ]4ub&7m3! AI-5KjPidq96769! AI-042]6%5.=960! | 2026-10-01 06:09 |
| SP network cipher | [Click to reveal]import sys;M=2**64-1;A=0x61C8864680B583EB;B=0xBF58476D1CE4E5B9;T=bytes.fromhex("eeb3909781dbdfafc2c5") def S(K,n): c=K&M;p=[] for _ in range(4):a=c%n;v=(c//n-A)&M;b=v%n;c=(B*v+1)&M;p+=[(a,b)] return p def E(K,n): d=[0,0,0];a=K&M;k=[] for _ in range(n): d[0]+=1 if d[0]>3:d[0],d[1]=0,d[1]+1 if d[1]>3:d[1],d[2]=0,d[2]+1 if d[2]>3:d[2],d[1]=0,d[1]+1 a=(a+sum(d))&M;k+=[a&255] return k def F(s,K): n=len(s);a=[*s] for i,j in S(K,n): if i-j:a[i],a[j]=a[j],a[i] l=K&255;h=K>>8&255^90 if l-h:a=[h if x==l else x for x in a] return bytes(x^y for x,y in zip(a,E(K,n))) def G(K): n=len(T);k=E(K,n);s=bytes(c^d for c,d in zip(T,k));l=K&255;h=K>>8&255^90 if l-h:s=bytes(l if x==h else x for x in s) a=[*s] for i,j in S(K,n)[::-1]:a[i],a[j]=a[j],a[i] assert F(bytes(a),K)==T;return bytes(a) if __name__=="__main__":K=int(sys.argv[1])if len(sys.argv)>1 else 43444956;sys.stdout.buffer.write(G(K)+b"\n") | 2026-10-01 05:30 |
| Matryoshka VM | [Click to reveal]> echo "WL7s3EU9i!bN!264!5qhx_3q" | crackme.exe Enter password: [+] Correct! All five virtual machines agree. You found the password. | 2026-09-30 05:31 |
| thefirsttest | [Click to reveal]1923855305 | 2026-09-30 04:44 |
| Automata Simulation | [Click to reveal]"nier". No hash though — nothing multiplies by 13, it just checks the four letters one at a time, any case. The documented patch gets the pods working but you still can't win: the ending is behind a flag nothing ever sets, and that flag is also what stops enemies spawning, so the field never clears. Pointed it at the flag your key sets instead — ends in ~3 seconds. "NierSecretChallenge" class name. Loved it. Good one. | 2026-09-29 19:28 |
| polynomial-crack | [Click to reveal]aboba hackers_password rtURgX6doA00GAkxlptIL2YbpwqsCteJ2 KnTUFtk JIYIvaPEvvnaLXVNMREs OXngfI51SUf5HCTJ Y9 7n5Xxt8yz902OhBywJayJUfOFJskSZoERBmifSM2db qipEKig4eK5IT 8 iK2 | 2026-09-29 16:47 |
| Fugsv1.1 | @Leotrungkien thank you :) | 2026-09-29 10:07 |
| Inside the Machine | [Click to reveal]PS> echo "V1rtu4lM4ch1n3_1ns4n3_2026" | .\crackme.exe ================================================= VM Crackme - custom virtual machine Goal: find the password. ================================================= Enter password: [+] Correct! The machine accepted your password. EXITCODE=0 | 2026-09-29 06:48 |
| reaper maze | [Click to reveal]R7v!K2m#Q9z@ | 2026-09-29 06:47 |
| Fugsv1.1 | [Click to reveal]@@___BRO__VERY__Handsome__@@0X000000000123AASSSDKJDJD@(@+#-#&#&#&!*!*:'')@)@)0101)@/@/)#)#)))/))@(@(@@++(LOVE YOU))))..)@)@)@))@)@)@)@ | 2026-09-29 06:43 |
| Fugsv1.1 | [Click to reveal]====================================================================== FugsHunter Crack v1.01 - Good luck. ====================================================================== Guess the flag: @@___BRO__VERY__Handsome__@@0X000000000123AASSSDKJDJD@(@+#-#&#&#&!*!*:'')@)@)0101)@/@/)#)#)))/))@(@(@@++(LOVE YOU))))..)@)@)@))@)@)@)@ CORRECT!!🥰 | 2026-09-29 06:38 |
| Key | $ python keygen.py; "exit code: $LASTEXITCODE" test -> AAg->_:-1 verify=True fern -> AAg->_:-1 verify=True crackme -> AB6->_:-1 verify=True arshi -> AKy->_:-1 verify=True abcd -> AAg->_:-1 verify=True 0123456789abcdef -> ACO->_:-1 verify=True exit code: 0 | 2026-09-29 06:32 |
| Needle in a Haystack | [Click to reveal]kafkaesque_99 | 2026-09-29 06:04 |
| Embrace RSA | import hashlib,sys N=26496633762146499818860157002479052785659218298910846353636500220736231412584690289692744501740342807358419171842903405070650989567788641540165117027624320225446933431225525511492285704023402535919310959719360794704009709525500262891058503799496169869483101509242346719726416741871217047836570293584493819103414069216264429488563508552791368747404063573415512785968533726657435476727701944811983631450302904441386850741255186991265107621306375445936649071960768667376357094970090371446120123120541367583390506188146662593620959699733016715285538286615648530228310868951704708669286053275142959175387360446674197678933 D=0xC7E9393830E73D37B1C6D84DB03B4C75E4324CD7FE3854231FA41F6E2D4F4552DA263FC8FC136FA310C104A17C300FB0CB2C90B26D9558F637F2624D67118070FCF8B649694E625627A75ED811B36EB09376B498652F1206FD8F7F108F66ADF9F69BC029F1525021B788C5442B2834F75315821C51F3213BEBD05A1E623DF8B39A2BF6DB55103BE429145C0957958EF5828F770170F07DD04FA9402E965E0B056A01B379C2A55B3AA0C2CA05BA8EE9C060227A909A80D3EDBBD2EFE230FF1F7B6B684712C28A4E147D2F0D17679B36B6237855627BCE84992A11FBB42BC24206B5522A58248D120FFD0F0B721FF5F605E4779771818C1777824DBBF2BD15C681 u=sys.argv[1].strip() m=int.from_bytes(hashlib.sha256(u.encode()).digest(),"big") print(format(pow(m,D,N),"x")) | 2026-09-28 06:44 |
| Cortisol level low keygen | [Click to reveal]W=[1,3,7,9,1,3,7,9,1,3];k=lambda n:n+str((-(sum(int(c)*w for c,w in zip(n,W)))%10+10)%10);print(k("1234567890")) → 12345678903 → Ok, Ok you are not that dumb. :3 Full SHA256: 102cd396a16bb1aced9c4a768dfc93ea7de44509b53e8ee2d8699b33b1f42aca | 2026-09-27 18:46 |
| Cortisol level low keygen | W=[1,3,7,9,1,3,7,9,1,3];k=lambda n:n+str((-(sum(int(c)*w for c,w in zip(n,W)))%10+10)%10);print(k("1234567890")) → 12345678903 → Ok, Ok you are not that dumb. :3 Full SHA256: 102cd396a16bb1aced9c4a768dfc93ea7de44509b53e8ee2d8699b33b1f42aca | 2026-09-27 18:46 |
| ComputeTheKey | [Click to reveal]I started by triaging the target as a stripped 14528-byte PIE ELF64 x86-64 executable dynamically linked against libc (SHA-256 e30c8719bd92272bd817de64a0567067755f6eaeac337000e5f36cc6e14980f9, full RELRO, NX stack, no canary, .text only 0x337 bytes), and the tiny import table — just puts, strlen, memcmp, __printf_chk and __libc_start_main — immediately told me there was no scanf/fgets, so the key had to arrive as argv[1]. From _start's lea rdi,[rip+0x263] before the call to __libc_start_main I recovered that main lives at 0x1342, and the strings Usage: %s key, Incorrect key! and Correct key! at 0x2004/0x2013/0x2022 gave me the success and failure branches. The first gate was a simple length check — cmp rdx,[0x4020] with the qword 0x14 stored there means strlen(key)+1 must equal 20, pinning the key at exactly 19 characters — and the real puzzle sat in the instructions right after it, where main computes a djb2 hash (seed 0x1505, h = h*33 + c, helper at 0x1312) over its own code bytes in the range 0x1342..0x13e5 and stores only the low byte into keystream slot 0 at 0x4018, meaning the byte sitting in .data there is a deliberate decoy and the real first keystream byte only exists at runtime. The transform routine at 0x11c3 then splits the 19 payload bytes into blocks of (19-1)/3 = 6 (via a 64-bit div by the qword 3 at 0x4010) and applies a self-inverse rotating XOR using xor_block at 0x11a9: s[0..5] ^= ks[0], s[6..11] ^= ks[1], s[12..17] ^= ks[2], and s[18] ^= ks[0] in the tail loop at 0x1236, after which the sete byte ptr [rax] at 0x12e4 rewrites the string's NUL terminator to 0x01 — which explains why the reference buffer stored at 0x4030 ends in 01. With the effective keystream computed as fd c0 de and the stored ciphertext being a5 a2 ae b8 be af 85 94 9f 8b 85 99 81 86 81 ef ed ee ca 01, the final check is a single memcmp(argv[1], 0x4030, 20) at 0x13ce, so because XOR is its own inverse there was no search whatsoever — simply plain[i] = cipher[i] ^ ks[(i/6) % 3] yields the key X_SECRET_KEY_X_1307, and I confirmed it by executing a byte-for-byte copy of the untouched original (still SHA-256 e30c8719bd92272bd817de64a0567067755f6eaeac337000e5f36cc6e14980f9), which printed Correct key! and exited 0 with no patching, no forced branches, and no modification to the binary. | 2026-09-27 18:17 |
| Spaghetti Keygen | @TeRrArIsT It's not a problem with your skill the only actual check is 12th (0x2f92), all of the others always return 1. It doesn't carry out an xor operation on the letters. For each character c: ebx = ((c ^ (c+2)) * 0x4D2) % 0x8D eax = mt19937_64_output(state after feeding c) pass if ebx == eax For example, 'P'=0x50. (80^82)=2. 2*1234%141=71. MT also gives 71. So P*8..123 passes. The funcs which are labelled as "empty" are merely noise produced by libstdc++: 0x41FC stands for nop, 0x4063 for return 0, 0x420C for return arg, 0x4134 for *iter, 0x4110 for ++iter, 0x40D0 for iter!=, and 0x42EE/0x439E/0x4624/0x4742 are used for mt seed/gen/twist. You should ignore these and instead hook only the begin and end functions whilst emulating 0x2f92 in this way you'll obtain (71,71) as the result for P. | 2026-09-27 16:04 |
| Spaghetti Keygen | import random print("P"*random.randint(8,123)) | 2026-09-27 16:02 |
| Orrery | [Click to reveal]The orrery (keygenme by SVz) has been solved. On day 20686 (ORRERY_DAY), when the name "CrackMe" is used, the serial number generated is TWCB-TC6H; executing the command `orrery.exe CrackMe TWCB-TC6H` causes the program to output "system charted - ORRERY{8407B3CC}" (with an exit status of 0). The method used was to realise that the 32 border probes (those that are absorbed, reflected or deflected) are merely echoes from a 10x10 board — if a probe goes straight it is absorbed by the cell in front of it, otherwise the two diagonal cells determine what happens: if both do, the probe is reflected; if one does, it makes a 45-degree mirror bounce; if neither does, the probe goes straight; the day only selects which of the 32 echo bytes to read from a pre-existing 3653x32 table in the .rdata section, so I reversed the physics, searched through the C(64,5)=7,624,512 different five-planet combinations (including 2 sound prunes, with a unique result each time), and packed the five winning cells as 5x6 bits, XORed with a 30-bit FNV-1a hash of the name after it has been trimmed and converted to uppercase, plus a 10-bit FNV checksum, resulting in 8 base32 characters; the ORRERY{...} fingerprint is only calculated after a successful replay has taken place, so it is impossible to forge it by means of a forced branch, and my keygen correctly predicted the value 8407B3CC before the binary was run — 156 name/day pairs were accepted with matching fingerprints, the binary was never modified, the SHA256 hash of orrery.exe is B98A16BC879F602672C7B7C5A64E0AA4A4C9824BC9D1DFFBE6BEE0C95AC669AD, and orrery E7B111C058E66F86321B7CE75B2C1C8EF414F2989C40DF970A9AE47621541006. | 2026-09-27 14:24 |
| CrackmesForBeginners (CFB) #9 | [Click to reveal]The exe had no security logic at all. It just looked for a validator.dll that wasn't shipped, loaded it from its own folder, and trusted whatever VerifyLicense returned. That's the whole crackme. No packing, no anti-debug, no delay-loads. IDA decompiled main() in one shot and the entire access check was a single instruction: cmp eax, 0x1337C0DE. That number is just the author's signature "leet" in hex. Nothing else in the program ever looks at what you typed. So the whole solve was writing a 40-line DLL that exports one function returning that number, dropping it next to the untouched exe, and running it. ACCESS GRANTED, first try. No patching, no breakpoints, no iteration. The title gives it away: the easiest way to break a lock is to replace the guard. The exe trusted a file from its own directory with zero verification that's the real bug, not the missing DLL. | 2026-09-27 03:59 |
| CrackMe - v1.0.0 | zl7HjNJzlDH7oygG | 2026-09-26 21:41 |
| Simple Frog | @victormeloasm #!/usr/bin/env python3 # simplefrog keygen -> python3 keygen.py [name] (WSL/Linux + X; needs simplefrog next to this script) import os,sys,time,ctypes,hashlib,struct,shutil,select,errno M,C1,C2,V=(1<<64)-1,0xBF58476D1CE4E5B9,0x94D049BB133111EB,0xEE18D70B34696718 SRC=os.path.join(os.path.dirname(os.path.abspath(__file__)),"simplefrog");DST="/tmp/simplefrog" def R(x,r):x&=M;r&=63;return x if r==0 else((x<<r)|(x>>(64-r)))&M def gen(n,ts,w,h): v=0x14650FB0739D0383 for b in n:v=(0x100000001B3*(b^v))&M t=(C1*(v^(v>>30)))&M;t=(C2*(t^(t>>27)))&M;k=t^(t>>31);w,h,ts=w&0xFFFFFFFF,h&0xFFFFFFFF,ts&M a=R(ts,17)^((w<<32)&M)^h^V^R(k,31);s=(R(V,29)+R(ts,43)+k+0x53696D706C654672)&M;i,j,g,d=5,9,0,0 for _ in range(16): e=(a+R(s,i))&M;f=((0xD1342543DE82EF95*e)&M)^s;x=(g^e)&M;u=(C1*(x^(x>>30)))&M;c=(C2*(u^(u>>27)))&M a,s=c^(c>>31),R(f,j);d=s;i+=7;j+=11;g=(g+0x9E3779B97F4A7C15)&M return hashlib.sha256(n+b"\0"+struct.pack("<QQIIQQ",V,ts,w,h,a&M,d&M)).hexdigest() def dims(): x=ctypes.CDLL("libX11.so.6");x.XOpenDisplay.restype=ctypes.c_void_p;x.XOpenDisplay.argtypes=[ctypes.c_char_p];p=x.XOpenDisplay(None) for f,t in(("XDefaultScreen",ctypes.c_int),("XRootWindow",ctypes.c_ulong),("XDisplayWidth",ctypes.c_int),("XDisplayHeight",ctypes.c_int)):getattr(x,f).restype=t s=x.XDefaultScreen(p);rt=x.XRootWindow(p,s);w,h=x.XDisplayWidth(p,s),x.XDisplayHeight(p,s) try: r=ctypes.CDLL("libXrandr.so.2");r.XRRGetMonitors.restype=ctypes.c_void_p;r.XRRGetMonitors.argtypes=[ctypes.c_void_p,ctypes.c_ulong,ctypes.c_int,ctypes.POINTER(ctypes.c_int)];n=ctypes.c_int(0);m=r.XRRGetMonitors(p,rt,1,ctypes.byref(n)) if m and n.value>0: for i in range(n.value): G=lambda o:ctypes.cast(m+i*56+o,ctypes.POINTER(ctypes.c_int)).contents.value if G(20)<=0<G(20)+G(28)and G(24)<=0<G(24)+G(32):w,h=G(28),G(32);break r.XRRFreeMonitors.argtypes=[ctypes.c_void_p];r.XRRFreeMonitors(m) except OSError:pass return w,h def sec():# fail only clock_gettime(CLOCK_MONOTONIC) -> binary's fixed-entropy branch class F(ctypes.Structure):_fields_=[("c",ctypes.c_uint16),("t",ctypes.c_uint8),("f",ctypes.c_uint8),("k",ctypes.c_uint32)] class P(ctypes.Structure):_fields_=[("l",ctypes.c_uint16),("f",ctypes.POINTER(F))] p=[F(0x20,0,0,4),F(0x15,0,5,0xC000003E),F(0x20,0,0,0),F(0x15,0,3,228),F(0x20,0,0,16),F(0x15,0,1,1),F(6,0,0,0x50000|errno.EPERM),F(6,0,0,0x7FFF0000)] a=(F*8)(*p);q=P(8,a);l=ctypes.CDLL(None) if l.prctl(38,1,0,0,0)or l.prctl(22,2,ctypes.byref(q),0,0):os._exit(111) def go(n,w,h): ir,iw=os.pipe();orr,ow=os.pipe();pid=os.fork() if pid==0: os.dup2(ir,0);os.dup2(ow,1);os.dup2(ow,2) for fd in(ir,iw,orr,ow):os.close(fd) sec();os.execve(DST,[DST],os.environ);os._exit(127) os.close(ir);os.close(ow) def W(tag,b=8.0): d=b"";end=time.time()+b while tag not in d and time.time()<end: if not select.select([orr],[],[],max(0,end-time.time()))[0]:break c=os.read(orr,4096) if not c:break d+=c return d W(b"Name: ");fr=time.time()%1.0 if fr>0.3:time.sleep(1.05-fr) t0=time.time();os.write(iw,n+b"\n");W(b"Serial: ");t1=time.time();ok=s=None if int(t0)==int(t1): s=gen(n,int(t0),w,h);os.write(iw,s.encode()+b"\n");ok=b"Croak! Correct serial."in W(b"\n",6.0) else: try:os.write(iw,b"0"*64+b"\n") except OSError:pass os.close(iw);os.close(orr) try:os.waitpid(pid,0) except OSError:pass return ok,s def main(): shutil.copy(SRC,DST);os.chmod(DST,0o755);os.environ.setdefault("DISPLAY",":0") n=(sys.argv[1] if len(sys.argv)>1 else"frog").encode()[:127];w,h=dims();print(f"[*] name={n.decode('latin1')!r} dims={w}x{h}") for i in range(1,101): ok,s=go(n,w,h) if ok:print(f"[+] serial: {s}\n[+] Croak! Correct serial. (attempt {i})");return 0 print("[-] gave up");return 1 sys.exit(main()) | 2026-09-25 09:02 |
| Simple Frog | Serial = SHA256(name + monotonic/mouse entropy + wall-clock sec + screen dims), so it changes every run. Raw syscalls, so no LD_PRELOAD faketime. Escape hatch in main: if (clock_gettime(CLOCK_MONOTONIC,&t) < 0) { v26 = 0xEE18D70B34696718; ptr=(0,0); } If that read fails, the whole timing/mouse loop is skipped → entropy becomes a constant and pointer=(0,0) forces the deterministic screen-dims branch. Can't patch/hook/inject the binary — so I filtered it at the kernel: seccomp-BPF returning EPERM only for clock_gettime(CLOCK_MONOTONIC), CLOCK_REALTIME allowed. fork → install filter → execve the untouched ELF (filter inherited). Now everything's deterministic. Reimplemented the math (FNV → splitmix64 → 16-round mixer → SHA-256), read monitor size via Xrandr, used the current second, fed the serial back same-second. Croak! Correct serial. | 2026-09-24 16:45 |
| Crackme C++ | virtualized & packed | [Click to reveal]S3cr3tP@ss | 2026-09-24 16:09 |
| Wheredakey | [Click to reveal]BashQc3fZ16AjD701x0O | 2026-09-24 14:32 |
| Fugs | [Click to reveal]My friend is really crazy haha_000XXX1101010999999998888999999__FUCKYOU____LOVEYOU_😁😁😁 | 2026-09-24 10:09 |