| CERBERE |
solved, really nice one. the three stages chain together well, and i liked that the second vm only decrypts once you have the first part right. the lattice step was tighter than i expected lol, plain LLL wasn't enough for me and i had to enumerate. anti-debug being baked into the key derivation is a nice touch too. nice work!
|
2026-10-05 14:03 |
| Simulation password |
solved, nice idea.
btw, it needs libmingwex-0.dll which isn't included, exe won't start without it. also pretty sure you can't type the answer, printable ascii doesn't reach the threshold so i had to pipe raw bytes in from a file :3
|
2026-10-05 13:25 |
| CrackmesForBeginners (CFB) #5 |
[Click to reveal]Nice crackme. Used i traced the comparison block in the main function to extract all 8 bytes (0x1b, 0x13, 0x01, 0x20, 0xd0, 0x44, 0x07, 0x11), then used a Z3 SMT solver to invert the 4 generation GoL transition with an ASCII constraint. Anyone wanting to do the same should note the bit ordering: password char i maps to row i of the grid, with bit j = column j (LSB = col 0), and all grid cells live on a wrapping (toroidal) boundary!
|
2026-06-11 01:03 |