Questions tagged [crackme]
Little Puzzle Applications for Reverse Code Engineers, with the goal to break a protection scheme legally for exercise. These often have a lot of built-in security to prevent attackers from succeeding, at the end the reverse engineer often writes a so-called keygen (key generator) and a paper to show s/he succeeded and how.
83
questions
1
vote
0
answers
158
views
How would one go about finding the key to this crackme (polynomial - childhood crackme)?
I'm trying to solve a crackme that contains a key check like so:
lVar4 = vulnerability1(passwd);
if (lVar4 == 0x260a4c7d7af23fc0) {
solve_check(1,0xffffffff);
free(passwd);
...
- 111
1
vote
1
answer
147
views
Where is the XOR operation?
I am doing TryHackMe REloaded room, level 3.
When I got stuck I followed this tutorial which mentions an XOR by 7 operation being performed on a string, however I cannot see it anywhere.
Where is it ...
- 185
3
votes
0
answers
47
views
Contents of EAX in IDA Free?
I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges.
In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is ...
- 185
3
votes
0
answers
783
views
Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)
I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app.
Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The ...
- 31
2
votes
1
answer
137
views
What are the prerequisite knowledge needed to start solving crackmes?
I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86.
School just ended, I'm working on cracking a game called ...
2
votes
0
answers
61
views
Wrong EP on an .elf CrackMe
I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
- 21
0
votes
1
answer
153
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
- 1
1
vote
0
answers
101
views
Patching out relative calls to DLL functions
I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag ...
- 23
0
votes
1
answer
105
views
Z3 is unable to predict the operand
When I try to solve this crackme chall (https://crackmes.one/crackme/61ffb07c33c5d46c8bcbfc1d) , there is a condition that I can't bypass and my z3 script can't predict the input string that will ...
- 115
0
votes
1
answer
104
views
Crackmes challenge not validating all answers
I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
1
vote
0
answers
265
views
x64dbg placing a on write breakpoint on a dynamic allocated address
I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
- 11
3
votes
0
answers
67
views
Cutter console does not show printf result
I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
- 31
0
votes
0
answers
134
views
Game Hacking Prevention - General Question
So I'm in a middle of developing an online video game for Windows and was wondering, how does games' hacking is even possible?
I mean, assuming I calculate the HP and the location of every player in ...
- 1
0
votes
1
answer
1k
views
How to bypass anti-debugging C++
So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it.
I even tried using ScyllaHide at max settings but still it detects ...
-1
votes
1
answer
1k
views
A Process does not list on x64dbg attach list
I'm learning RE with x64dbg on Windows10.
It does not list a process in the running process list that I want to attach.
The Process is running 32-bit crackme application for learning.
It was created ...
- 141
0
votes
0
answers
160
views
Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?
I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
- 103
0
votes
1
answer
830
views
Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?
I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
1
vote
1
answer
253
views
Crackme assistance - change input of a function
Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
- 11
0
votes
0
answers
74
views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
1
answer
78
views
Password evaluated from the sum of ASCII letters
After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
- 3
1
vote
1
answer
407
views
Basic `angr` framework question- is something wrong with my solver?
I'm new to reverse engineering and I've just recently learned about angr, a framework that uses symbolic execution to get the input for a given output. I'm trying to complete a crackme using angr. My ...
- 13
1
vote
1
answer
1k
views
Segmentation fault after export binary file in Ghidra even without any changes [closed]
I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
- 131
-1
votes
2
answers
993
views
Weird function names in disassembly (crackmes)
I'm doing a really easy crackmes exercise (https://crackmes.one/crackme/5e4ec05c33c5d4439bb2dbea) and I can't figure out what the binary is doing because functions have extremely weird names.
Here's ...
- 15
2
votes
1
answer
448
views
Where can I find the QRC and QML files used for a QT gui application when reverse engineering?
I'm currently working on a crackme exercise for a GUI application using QT as practice. The application uses a server login authentication.
I can see from the logs that the application output that ...
- 21
2
votes
1
answer
330
views
Finding the correct input of an executable to print out the flag. IDA 7
I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions):
.text:00C21034 Buf= byte ptr -...
- 123
0
votes
0
answers
124
views
Alternative APIs to hook instead of messagebox for message pop ups?
So i am reversing an app that pops up a message at some point, but its not doing this using messagebox
i also tried to pause and then run to user code but didn't work, so what are some of the other ...
- 232
0
votes
1
answer
2k
views
How to change the title of a windows GUI app when patching? (the title that usually writes the application name)
So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
- 232
3
votes
0
answers
146
views
Z3 and If-logic
Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it:
def fact(x):
if x == ...
- 111
2
votes
1
answer
827
views
Reverse getline(cin, text)
I'm trying to solve a crackme that was made in C++, and I was able to
"recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse:
...
- 69
0
votes
2
answers
84
views
Figuring out correct user input key from final key + generated buffer
I've recently gotten into reversing crackmes, and I seem to always fail at the ones similar to this.
The final key that the program uses for comparison is not the key that should be used as input, ...
user29468
3
votes
2
answers
1k
views
In reverse engineering, what does it mean to "patch a file"?
I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
- 69
5
votes
2
answers
6k
views
Can I trap SIGSEGV (on a Linux) and what are are the conditions to make it works? (for a crackme)
I'm writing some crackmes.one challenge and I want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way to segfault. It should ...
- 163
1
vote
1
answer
1k
views
How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?
I have decompiled exe using pyextractor script and generated
these files:
PYZ-00.pyz
PYZ-00.pyz_extracted
gui
pyi_rth_tkinter
pyi_rth_multiprocessing
pyi_rth_pkgres
pyi_rth_win32comgenpy
...
- 21
0
votes
0
answers
3k
views
How to generate exe from compiled Python files?
I have extracted compiled files from exe (executable in windows) using
PyInstaller Extractor script.
In Resultant folder, i have got was pyc files bundled in pyz folder.
Then I decompiled files (...
- 21
1
vote
0
answers
256
views
Mysterious chunk of code in IOLI crackme0x06 challenge
I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge.
Context
But first of all, here is the context : I've successfully cracked the ...
- 51
0
votes
2
answers
284
views
crackme disassembly - are these local variables ever initialized?
I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
- 103
1
vote
0
answers
259
views
Password is right, but still wrong?
i am trying to find the password of a binary with radare2 - a crackme again :-)
I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
- 23
3
votes
1
answer
10k
views
How to print the value of register with Radare 2
I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code.
radare2 ch3.bin
[0x080482f0]> aaa
[[anal.jmptbl] Missing cjmp bb in ...
- 221
2
votes
1
answer
660
views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
- 221
3
votes
2
answers
1k
views
Are there any crackme sites made for cheat engine or to practice game hacking particularly?
I've checked several crack me sites and they're all on reverse engineering applications.
However, I would like to practice reverse engineering by manipulating game values. The cheat engine tool ...
- 133
1
vote
0
answers
158
views
Looking for crackme with full solutions [duplicate]
There are lot of crack me site.
I looking for site that have lot of hard crack me/ malware to research anti debug/anti vm... but with full solution
- 523
3
votes
1
answer
409
views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
0
votes
2
answers
570
views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
- 877
1
vote
2
answers
445
views
How to reach functions triggered by non-standard buttons?
I've already read related posts such as:
link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg
link2: How can I set a breakpoint for a button ...
- 89
0
votes
1
answer
117
views
Keygenme - Key location
So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction:
...
- 407
2
votes
2
answers
675
views
How can I reverse this recursive function?
This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does.
def the_process(stored, inp, size):
idx = 0
...
- 23
1
vote
1
answer
189
views
Static Offset in PE
I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password.
The problem is I use a part of code into the main function to search the opcodes from .text section ...
- 111
-1
votes
1
answer
263
views
What is a "goodboy/badboy" [closed]
I'm confused and I'm trying to follow the Radare 2 Crackme Challanges. In it, they say,
This seems to be a goodboy/badboy.
Is a "goodboy/badboy" lingo for a specific thing, and if so what?
- 1,769
0
votes
1
answer
274
views
Example of key fishing with OllyDbg logging? [closed]
I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
- 3
0
votes
1
answer
754
views
brute force remote nop sled memory address
ELF x64 binary on a remote server communicates via simple socket server in C.
After overflowing the buffer (total buffer is 2000, password buffer is less), overwriting the RIP, filling with NOP sled (...
- 273