| Find a password |
[Click to reveal]ASOINdiu129021j90e12
|
2026-11-09 14:39 |
| dc540-0x0000a |
@kevinthomas great Iot hardware reverse program,I only found the {th3_s3rp3nt_ was right as I verified in this HW, maybe is not correct to your goal,but I tried my best,maybe I should learn more
|
2026-11-07 13:16 |
| VSEC ALPHA-VM CrackMe |
@VSEC That's OK.Maybe it would be challegable for me now, I hope one day you could share the write-up
|
2026-11-07 05:29 |
| VSEC ALPHA-VM CrackMe |
@VSEC Thanks for the hint — username confirmed as crackmes.one@gmail.com.
The check gate is HMAC-SHA256(PBKDF2(pwd, A, 200000)[32:64], msg) == D, so the serial
is still a free variable that can't be derived from the username (tried ~135k derivations:
topic words, MD5/SHA digests in all classic formats, HMAC/PBKDF/AES chains built from the
binary's own constants and primitives — zero hits). Could you share the serial itself?
Once I have it, the flag pipeline (AES-256-CBC with key=dk[0:32], iv=B, ct=C) is already
fully reversed and will print the flag immediately.
|
2026-11-06 17:49 |
| VSEC ALPHA-VM CrackMe |
@VSEC
Thanks for your hint, I will try it.By the way, do you have telegram oo discord or any media,so I can directly talk with you about reverse enginerring.
|
2026-11-06 15:58 |
| VSEC ALPHA-VM CrackMe |
@VSEC
Great nested-VM + metamorphic build — but as published, the challenge has no valid input.
I reversed the full check chain:
1. password = "CMO-CRACKME-V2" || 0x00 || be32(len(user)) || user || be32(len(serial)) || serial
2. dk = PBKDF2-HMAC-SHA256(password, salt=98fb686a2a90ae3ef452e904427e8956, iters=200000, dkLen=64)
3. tag = HMAC-SHA256(key=dk[32:64],
msg="CMO-AES256-CBC-HMAC-SHA256-V1" || 0x00
|| 98fb686a...e8956 || e39ec235...b48f || b2e00b0d...6939(48B))
4. success <=> tag == fcede17aa08cce73f5a1e8b5b3eea64e980a47f9d197bd213a4ec592f0d5718b
5. flag = AES-256-CBC-Decrypt(key=dk[0:32], iv=e39ec235...b48f, ct=b2e00b0d...6939), PKCS#7-unpad, printed
The issue: step 4 is a plain 256-bit HMAC equality against a fixed constant, and the HMAC
key comes from a 200k-iteration PBKDF2 of the user input. There is nothing to invert here:
no expected username/serial is stored anywhere in the binary (checked .rdata/.data/.rsrc,
section slack, TLS, resource strings — only the four constants above exist), and the
comparison target D is just a tag, not something a keygen can derive from the input.
So your hint "no need to brute-force, all algorithms are reversible" holds for the VM,
the metamorphic bytecode layer and the AES stage (I verified the whole pipeline end to end
by hooking PBKDF2/HMAC/AES in a debugger — recomputed tags match runtime values, and
substituting my own key/ct at the AES call makes the program print my plaintext as the flag),
but the gate itself is a 2^256 preimage over a one-way KDF. The only ways in are
brute-forcing PBKDF2 (~7 tries/sec/core measured) or patching the compare — which is what
"please don't brute force" was trying to prevent, I assume.
Fix suggestions, pick one:
- publish the intended username/serial (or its expected tag) with the challenge, or
- make the final comparison verifiable from the input (e.g. compare against
HMAC(dk[32:], msg) where the recipe is public, so a keygen is possible), or
- ship a small keygen/checker alongside.
The VM part is genuinely fun: per-byte keystream-encrypted bytecode regenerated each run,
24-handler dispatch table, and the opcode normalizer (0xFE -> 0x16, >0x15 -> 0x17) as the
metamorphic trick. The 48-byte blob decrypts with perfectly valid PKCS#7 padding once you
hold dk[0:32], so the flag stage itself is fine — it just needs its key to be reachable.
|
2026-11-05 14:09 |
| CrackMe Hard 2 |
@VladMetz Thanks, you can solve my newest crackme called CrackMe Hard 5
|
2026-06-07 12:39 |
| NUCLEAR PROJECT 2 |
[Click to reveal]the python script is following:
gen.py:
def gen_password(username: str) -> str:
result = []
for c in reversed(username):
result.append(c)
n = int(str(ord(c))[::-1])
if 32 <= n <= 126:
result.append(chr(n))
else:
result.append("x")
return "".join(result)
def main():
username = input("Enter username: ")
if len(username) < 4:
print("Username must be at least 4 characters long.")
return
password = gen_password(username)
print(f"Password: {password}")
if __name__ == "__main__":
main()
|
2026-06-02 05:57 |
| NUCLEAR PROJECT 2 |
@j2cks1337 ez by lbx
crackmes.exe
===============================
===NUCLEAR HIPPIE MONEY GANG===
===============================
Enter username: liboxin
Enter password: nxixxxoobYixlx
Authentication successful! Welcome, liboxin!
|
2026-06-02 05:16 |
| CrackMe Hard 4 |
@MouadDS CrackMe
|
2026-06-01 04:42 |
| CrackMe Hard 4 |
@zqdev @karabatik yes, you both did a good job, and thanks for your advice, and if you don't mind, could you leave any social media for me, so we can talk about reverse engineering.
|
2026-05-31 13:27 |
| CrackMe Hard 3 |
@ogurets8235 VHARD{VMX-T1M3-L0CK-9F2} is the right answer, I try again bro, did you patch the program???
|
2026-05-30 11:34 |
| CrackMe Hard 3 |
@KasperskyLabsEngineer fantastic，could you make a write-up to share how you solve it for us,I am looking forward to it.
|
2026-05-29 16:39 |
| CrackMe Hard 3 |
@KasperskyLabsEngineer fantastic，could you make a write-up to share how you solve it for us,I am looking forward to it.
|
2026-05-29 16:39 |
| CrackMe Hard 3 |
@jhon_crack could you share how you did it??
|
2026-05-29 03:02 |
| CrackMe Hard 2 |
@jhon_crack could you share how you did it??
|
2026-05-29 03:01 |
| first golang crackme |
Enter password: simba123
CORRECT!
mov r8,33323161626D6973 == (0x73, 0x69, 0x6D, 0x62, 0x61, 0x31, 0x32, 0x33) == simba123
cmp qword ptr ds:[rdx],r8
ez by lbx
|
2026-05-28 08:34 |
| CRACKME |
Enter password: simba123
CORRECT!
|
2026-05-28 08:21 |
| Simple VM Crackme |
@talhasa ez by lbx
Please enter the key: c0rRect!
Key is correct! Good job!
|
2026-05-26 12:27 |
| CrackMeBaby2 |
@igr0t7 ez by liboxin
==============================================================
Input the pass:
flag:igr0t-theking
You are good , but...
Say my name...
igr0t
You Win.. (;
1."lfkm0cmx:~'~boacdm" every char xor 0xA == flag:igr0t-theking
2.author name == igr0t
then pass the procedure
|
2026-05-22 03:45 |
| PhantomGate |
@AdminX by the way, what is your discord nickname/username ???
|
2026-05-19 10:44 |
| PhantomGate |
@AdminX yes, I have discord, my discord nickname is golden_unicorn_89655, you can search and add me,and we can talk with reverse engineering
|
2026-05-19 04:46 |
| PhantomGate |
[Click to reveal]@AdminX your crackme is fun, the information strings are encoded by a func, and decoding while running, and the core check func has VM check and Z3 symbol check and XXXXX-XXXXX-XXXXX-XXXXX format check, but luckily, I finally solved this, and I wrote a write-up here, and you can try to read it
|
2026-05-18 11:54 |
| PhantomGate |
@AdminX
PhantomGate v1.0 -- Reverse Engineering Challenge
Enter serial (XXXXX-XXXXX-XXXXX-XXXXX): 4QJCG-P4R7Y-3VMY7-XRWHM
[+] Access Granted! The gate yields. Well played, Reverser.
Press ENTER to exit...
|
2026-05-17 17:29 |
| Find the decryption key | Custom packer,no virtualization #2 |
@deo I've dumped the file by using x64dbg, but it seems like the dumped file is not totally unpacked and it's very hard to find the logic of the decryption,is there any one solved this crackme, if someone solved, please share your solution and write-up,it's a very crazy crackme, and now I'm going to be crazy
|
2026-05-13 13:43 |
| Smidge's crackme |
@Smidge
interesting,your crackme use MT19937 to gen a random string Code, and the password is (username + randomCode + reverse(username)), here is the result:
Input user: liboxin
Input password: liboxinXhbIUNFEZjnixobil
Congrats
Welcome in !
|
2026-05-12 17:14 |
| CrackMe#1 |
[Click to reveal]@iseey0u-re
An interesting Crackme, when the exe file under the debugger, the xor key will be changed from 93 to 109, and I finally solved this
Enter the password: crackmes
Success!
|
2026-05-12 12:26 |
| InputPrinter |
@khaledddd a good pwn challenge，I've pwned your elf file by writing the shellcode and overflowing the buffer
liboxin@ubuntu:~/pwn$ ls
exp.py flag vuln
liboxin@ubuntu:~/pwn$ python3 exp.py
[+] Starting local process './vuln': pid 82795
[+] buf = 0x7ffd6fb42630
[*] Switching to interactive mode
$ ls
exp.py flag vuln
$ cat flag
flag{pwned_by_liboxin}
$
|
2026-05-09 16:16 |
| KeygenMe_3_SWD |
[Click to reveal]Username: liboxin
Secret code: 0G8A-03U06-F0M
Verification PIN: 1030886717
Secret code -> PASS
Verification PIN -> PASS
a good crackme, it stuck me sometime, but I finally made it
|
2026-05-08 12:39 |
| VaultBreaker |
[Click to reveal]Op3nS3same
|
2026-05-07 05:35 |
| DebugMe |
[Click to reveal]@Ben_Lolo so the solution of the crackme is to write the hook code to hook the debugger-checker API to pass all the verification stages instead of patching the file or register, right ?
|
2026-05-06 15:21 |
| Cultures Puzzle |
@zqdev could you tell me how to find the key of stage 2, bro, I was stucked in here
|
2026-05-04 16:22 |
| DebugMe |
[Click to reveal]@Ben_Lolo your file should be being under debugged to get the right solution on Linux,being under the debugger, the file would be triggerred into the verify procedure, is that right???
|
2026-05-04 16:16 |
| DebugMe |
[Click to reveal]$ ./DebugMe_patched 0
DebugMe stage 1: Pass
DebugMe stage 2: Pass
DebugMe stage 3: Pass
Well done :)
|
2026-05-03 13:46 |
| Tenzo Crackme |
== Tenzo Crackme ==
Enter password: wowyoufoundit
Congrats! Access granted. You found the right password.
Press Enter to exit...
|
2026-04-30 15:59 |
| CrackMe Hard |
@DevVolodya that's OK, I'm waiting here to see your write-up
|
2026-04-30 04:40 |
| kernix! |
C:\Users\lenovo\Desktop\69eac2a53fba64e45dcea8a1>kernix.exe --sign correct_test.bin
signed. hash = 0xCDCC2520
kernix.exe is now sealed. ship it.
[sign] ok
|
2026-04-29 13:31 |
| CrackMe Hard |
@qobyce you did a good job bro, can you share your solution or make a write-up for others
|
2026-04-29 11:31 |
| aola |
b.exe
Enter password: Yippie-Ki-Yay
ok
|
2026-04-29 11:29 |
| JustTry crackme |
username:123
Serial:f01e16c07344b098
|
2026-04-23 06:16 |
| Simple login crackme |
User: 123
Pass: 49307604
Access granted
|
2026-04-17 05:33 |
| Simple login crackme |
User: 123
Pass: 49307604
Access granted
|
2026-04-17 05:33 |
| Find The Key |
[Click to reveal]Enter the magic number : 4
Enter Activation Key: ZW-ZZ
Z+{Act1va7i0n}
You must input like %%-%%(% -> the char you input), your input string length must be 5, and input[3] - input[1] == 3,and each char you input must be a capital letter, like AA-DA, ZA-DA,etc
|
2026-04-16 13:52 |