| NeuroVault |
solved in 4 minutes: `NV-4E563031-VAULT`
how to solve:
imports:
fgets
fputs
strcmp
strlen
strncmp
IsDebuggerPresent
NtQueryInformationProcess
in strings we can see marker:
VAULT
input flow:
prompt is printed with fputs
serial is read with fgets
program removes '\n'
then converts input to uppercase
format check:
call strlen
cmp rax, 0x11 ; length = 17
cmp byte ptr [rsi], 0x4e ; 'N'
cmp byte ptr [rsi+1], 0x56 ; 'V'
cmp byte ptr [rsi+2], 0x2d ; '-'
cmp byte ptr [rsi+0xb], 0x2d ; '-'
lea rcx, [rsi+0xc]
lea rdx, [rip+...] ; "VAULT"
call strcmp
so serial format is:
NV-XXXXXXXX-VAULT
middle part:
XXXXXXXX must be 8 hex chars
allowed chars: 0-9 or A-F
then these 8 hex chars are decoded into 4 bytes.
VM opcodes:
opcode 5 pushes one of the 4 input bytes onto the stack
opcode 1 pushes an immediate value
opcode 2 subtracts
opcode 3 adds
opcode 4 performs XOR
opcode 6 compares two values
opcode 7 performs AND
opcode 8 finishes the check
after decrypting the VM bytecode we get:
05 00 05 01 02 01 A4 06
05 02 05 03 03 01 01 06
07
05 00 01 04 04 01 E4 06
07
05 01 05 02 09 01 20 06
07
05 03 05 00 0B 01 E3 06
07
08
translated into conditions:
b0 - b1 == 0xA4
b2 + b3 == 0x01
(b0 xor 0x04) == 0xE4
rol(b1, b2) == 0x20
b3 - b0 == 0xE3
solving these conditions gives the decoded 4 bytes:
4E 56 30 31
as ASCII:
NV01
hex encoded:
4E563031
final serial:
NV-4E563031-VAULT |
2026-05-25 15:48 |