Automating a crackme solving process

Question

Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for automating the following:

1. Load executable
2. Put breakpoint at a known address
3. Provide a password as input for the executable
4. When reaching the breakpoint set eax to 1
5. Save any output of the executable

Answer 1

windbg in windows and gdb in linux both are capable of executing scripts to automate tasks

what you ask should be doable fairly easily in both of the debuggers

here is a demeo for windbg

source for a simple crackme that takes a password

:\>cat simcram.cpp
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int checkpass(char *pass) {
    return strcmp("goodboy" , pass);
}
int main(int argc , char *argv[] ) {
    if(argc != 2 ) {
        printf("usage %s password\n" , argv[0]);
        exit(0);
    }
    int res = checkpass(argv[1]);
    if(res == 0 ) {
        printf("please proceeed to vault\n");
    } else {
        printf("access denied incorrect password\n");
    }
    return res;
}

executing directly on console

:\>simcram.exe
usage simcram.exe password

:\>simcram.exe foobar
access denied incorrect password

:\>simcram.exe goodboy
please proceeed to vault

a scripted execution that would set eax to 0 irresepective on any password

:\>cdb -c "g simcram!checkpass;gu;r eax= 0;g;q" simcram.exe abracadabragiligilichoo

Microsoft (R) Windows Debugger Version 10.0.16299.15 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: simcram.exe abracadabragiligilichoo


ntdll!LdrpDoDebuggerBreak+0x2c:
77b205a6 cc              int     3
0:000> cdb: Reading initial command 'g simcram!checkpass;gu;r eax= 0;g;q'

please proceeed to vault  <<<<<<<<<<<<<<<<<
quit:

Answer 2

If the number of instructions executed is proportional to the number of characters correct (i.e, maybe it's a simple byte-by-byte strcmp), then you could use instrumentation tools like Pintool to count the number of instructions executed, and use that to brute-force the password byte-by-byte. Here's an example of that.