Questions tagged [crackme]

Little Puzzle Applications for Reverse Code Engineers, with the goal to break a protection scheme legally for exercise. These often have a lot of built-in security to prevent attackers from succeeding, at the end the reverse engineer often writes a so-called keygen (key generator) and a paper to show s/he succeeded and how.

Filter by
Sorted by
Tagged with
1 vote
0 answers
42 views

Patching out relative calls to DLL functions

I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag ...
user avatar
  • 23
0 votes
1 answer
59 views

Z3 is unable to predict the operand

When I try to solve this crackme chall (https://crackmes.one/crackme/61ffb07c33c5d46c8bcbfc1d) , there is a condition that I can't bypass and my z3 script can't predict the input string that will ...
user avatar
0 votes
1 answer
75 views

Crackmes challenge not validating all answers

I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
user avatar
0 votes
0 answers
56 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
user avatar
1 vote
0 answers
39 views

Cutter console does not show printf result

I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
user avatar
  • 11
0 votes
0 answers
87 views

Game Hacking Prevention - General Question

So I'm in a middle of developing an online video game for Windows and was wondering, how does games' hacking is even possible? I mean, assuming I calculate the HP and the location of every player in ...
user avatar
  • 1
0 votes
0 answers
31 views

Hardware Breakpoint wont work on address created during runtime

I am currently trying to crack a crackme.exe. Before the jump, it compares the following (0 == not registered): cmp byte ptr ds:[eax+0x15FC], 0x0 If I normally load the .exe and try to go to the ...
user avatar
0 votes
1 answer
573 views

How to bypass anti-debugging C++

So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it. I even tried using ScyllaHide at max settings but still it detects ...
user avatar
0 votes
1 answer
380 views

A Process does not list on x64dbg attach list

I learning RE with x64dbg on Windows10. It does not listing process in running process list that I want to attach. The Process is running 32bit crackme application for learning. It was created by ...
user avatar
0 votes
0 answers
108 views

Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
user avatar
0 votes
1 answer
296 views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
user avatar
1 vote
1 answer
225 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
user avatar
  • 11
0 votes
0 answers
51 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
user avatar
0 votes
1 answer
72 views

Password evaluated from the sum of ASCII letters

After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
user avatar
  • 3
1 vote
1 answer
257 views

Basic `angr` framework question- is something wrong with my solver?

I'm new to reverse engineering and I've just recently learned about angr, a framework that uses symbolic execution to get the input for a given output. I'm trying to complete a crackme using angr. My ...
user avatar
  • 13
1 vote
1 answer
1k views

Segmentation fault after export binary file in Ghidra even without any changes [closed]

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
user avatar
  • 131
-1 votes
2 answers
605 views

Weird function names in disassembly (crackmes)

I'm doing a really easy crackmes exercise (https://crackmes.one/crackme/5e4ec05c33c5d4439bb2dbea) and I can't figure out what the binary is doing because functions have extremely weird names. Here's ...
user avatar
  • 15
2 votes
1 answer
292 views

Where can I find the QRC and QML files used for a QT gui application when reverse engineering?

I'm currently working on a crackme exercise for a GUI application using QT as practice. The application uses a server login authentication. I can see from the logs that the application output that ...
user avatar
2 votes
1 answer
174 views

Finding the correct input of an executable to print out the flag. IDA 7

I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions): .text:00C21034 Buf= byte ptr -...
user avatar
0 votes
0 answers
70 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
user avatar
  • 212
0 votes
1 answer
1k views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
user avatar
  • 212
3 votes
0 answers
131 views

Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
user avatar
  • 111
2 votes
1 answer
604 views

Reverse getline(cin, text)

I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse: ...
user avatar
  • 69
0 votes
2 answers
75 views

Figuring out correct user input key from final key + generated buffer

I've recently gotten into reversing crackmes, and I seem to always fail at the ones similar to this. The final key that the program uses for comparison is not the key that should be used as input, ...
user avatar
3 votes
2 answers
703 views

In reverse engineering, what does it mean to "patch a file"?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
user avatar
  • 69
5 votes
2 answers
4k views

Can I trap SIGSEGV (on a Linux) and what are are the conditions to make it works? (for a crackme)

I'm writing some crackmes.one challenge and I want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way to segfault. It should ...
user avatar
  • 153
1 vote
1 answer
963 views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
user avatar
0 votes
0 answers
2k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
user avatar
1 vote
0 answers
232 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
user avatar
0 votes
2 answers
228 views

crackme disassembly - are these local variables ever initialized?

I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
user avatar
  • 103
1 vote
0 answers
235 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
user avatar
  • 23
3 votes
1 answer
8k views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
user avatar
  • 221
2 votes
1 answer
434 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
user avatar
  • 221
3 votes
2 answers
1k views

Are there any crackme sites made for cheat engine or to practice game hacking particularly?

I've checked several crack me sites and they're all on reverse engineering applications. However, I would like to practice reverse engineering by manipulating game values. The cheat engine tool ...
user avatar
  • 133
1 vote
0 answers
157 views

Looking for crackme with full solutions [duplicate]

There are lot of crack me site. I looking for site that have lot of hard crack me/ malware to research anti debug/anti vm... but with full solution
user avatar
  • 503
3 votes
1 answer
361 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
user avatar
0 votes
2 answers
479 views

Automating a crackme solving process

Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
user avatar
  • 777
1 vote
2 answers
313 views

How to reach functions triggered by non-standard buttons?

I've already read related posts such as: link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg link2: How can I set a breakpoint for a button ...
user avatar
  • 89
0 votes
1 answer
109 views

Keygenme - Key location

So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction: ...
user avatar
  • 347
2 votes
2 answers
620 views

How can I reverse this recursive function?

This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does. def the_process(stored, inp, size): idx = 0 ...
user avatar
  • 23
1 vote
1 answer
154 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
user avatar
  • 111
-1 votes
1 answer
240 views

What is a "goodboy/badboy" [closed]

I'm confused and I'm trying to follow the Radare 2 Crackme Challanges. In it, they say, This seems to be a goodboy/badboy. Is a "goodboy/badboy" lingo for a specific thing, and if so what?
user avatar
  • 1,654
0 votes
1 answer
254 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
user avatar
  • 3
0 votes
1 answer
657 views

brute force remote nop sled memory address

ELF x64 binary on a remote server communicates via simple socket server in C. After overflowing the buffer (total buffer is 2000, password buffer is less), overwriting the RIP, filling with NOP sled (...
user avatar
1 vote
1 answer
437 views

Solving method of DLL crackme

I was given two DLL files (link) . The task is to get the flag from them. First what I've done - opened the first file (called original) in IDA and found the function called _GetFlag. As I understood,...
user avatar
  • 125
1 vote
1 answer
1k views

Reverse engineering of Managed C++/C# CrackMe

I'm reverse engineering the CrackMe which is written on Managed C++/C#. Arguments are "string" (email in this case) and "serial". Serial is somehow depends on string and I need to understand how. I ...
user avatar
  • 125
3 votes
1 answer
177 views

Weird looking assembly-code bunch

I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls): 0040E978 . 53 ...
user avatar
  • 185
5 votes
1 answer
2k views

Reverse engineering the virtual machine based crackme

I am currently working on some crackme, that has implemented an obfuscation technique, virtualisation. The virtual machine inside this crackme is a huge switch-case block (over 130 cases in it). I ...
user avatar
  • 185
21 votes
3 answers
37k views

Crack Me Material

I'd like to get started with reverse engineering. Some years ago I've seen many many program, so called "crack mes" to crack. When I searched for some this week I've found none. My Question is, can ...
user avatar
  • 219
1 vote
1 answer
167 views

Length requirement on IOLI crackme input

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all ...
user avatar
  • 11