Questions tagged [crackme]

Little Puzzle Applications for Reverse Code Engineers, with the goal to break a protection scheme legally for exercise. These often have a lot of built-in security to prevent attackers from succeeding, at the end the reverse engineer often writes a so-called keygen (key generator) and a paper to show s/he succeeded and how.

Filter by
Sorted by
Tagged with
0 votes
0 answers
243 views

How to decompile python .exe who compiled by Nuitka?

i have one file named hello.exe and compiled using nuitka by cmd : python -m nuitka --mingw64 --windows-icon-from-ico=ICON.ico --onefile --windows-company-name=NAME --windows-product-version=1.0 --...
Teswadha's user avatar
1 vote
0 answers
164 views

How would one go about finding the key to this crackme (polynomial - childhood crackme)?

I'm trying to solve a crackme that contains a key check like so: lVar4 = vulnerability1(passwd); if (lVar4 == 0x260a4c7d7af23fc0) { solve_check(1,0xffffffff); free(passwd); ...
efel's user avatar
  • 111
1 vote
1 answer
226 views

Where is the XOR operation?

I am doing TryHackMe REloaded room, level 3. When I got stuck I followed this tutorial which mentions an XOR by 7 operation being performed on a string, however I cannot see it anywhere. Where is it ...
securityauditor's user avatar
3 votes
0 answers
58 views

Contents of EAX in IDA Free?

I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges. In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is ...
securityauditor's user avatar
6 votes
1 answer
2k views

Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)

I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app. Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The ...
OREN YT's user avatar
  • 61
2 votes
1 answer
223 views

What are the prerequisite knowledge needed to start solving crackmes?

I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86. School just ended, I'm working on cracking a game called ...
buffednerdkid's user avatar
2 votes
0 answers
67 views

Wrong EP on an .elf CrackMe

I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
pericopo10's user avatar
0 votes
1 answer
156 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
dxAhax's user avatar
  • 1
1 vote
0 answers
141 views

Patching out relative calls to DLL functions

I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag ...
John S.'s user avatar
  • 23
0 votes
1 answer
112 views

Z3 is unable to predict the operand

When I try to solve this crackme chall (https://crackmes.one/crackme/61ffb07c33c5d46c8bcbfc1d) , there is a condition that I can't bypass and my z3 script can't predict the input string that will ...
IVs's user avatar
  • 137
0 votes
1 answer
113 views

Crackmes challenge not validating all answers

I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
Ronald Rivera's user avatar
1 vote
0 answers
403 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
Gero B.'s user avatar
  • 11
3 votes
0 answers
73 views

Cutter console does not show printf result

I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
Luigi 's user avatar
  • 31
0 votes
0 answers
150 views

Game Hacking Prevention - General Question

So I'm in a middle of developing an online video game for Windows and was wondering, how does games' hacking is even possible? I mean, assuming I calculate the HP and the location of every player in ...
NewGuy's user avatar
  • 1
0 votes
1 answer
2k views

How to bypass anti-debugging C++

So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it. I even tried using ScyllaHide at max settings but still it detects ...
Ahmed minegames's user avatar
-1 votes
1 answer
1k views

A Process does not list on x64dbg attach list

I'm learning RE with x64dbg on Windows10. It does not list a process in the running process list that I want to attach. The Process is running 32-bit crackme application for learning. It was created ...
KiYugadgeter's user avatar
0 votes
0 answers
181 views

Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
Yuran Pereira's user avatar
0 votes
1 answer
1k views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
Ronald Rivera's user avatar
1 vote
1 answer
264 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
Tyler's user avatar
  • 11
0 votes
0 answers
93 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
Gabriel Saul's user avatar
0 votes
1 answer
80 views

Password evaluated from the sum of ASCII letters

After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
M4l1s's user avatar
  • 3
1 vote
1 answer
458 views

Basic `angr` framework question- is something wrong with my solver?

I'm new to reverse engineering and I've just recently learned about angr, a framework that uses symbolic execution to get the input for a given output. I'm trying to complete a crackme using angr. My ...
V. Zed's user avatar
  • 13
1 vote
1 answer
1k views

Segmentation fault after export binary file in Ghidra even without any changes [closed]

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
Michael's user avatar
  • 131
-1 votes
2 answers
1k views

Weird function names in disassembly (crackmes)

I'm doing a really easy crackmes exercise (https://crackmes.one/crackme/5e4ec05c33c5d4439bb2dbea) and I can't figure out what the binary is doing because functions have extremely weird names. Here's ...
sbluff's user avatar
  • 15
2 votes
1 answer
521 views

Where can I find the QRC and QML files used for a QT gui application when reverse engineering?

I'm currently working on a crackme exercise for a GUI application using QT as practice. The application uses a server login authentication. I can see from the logs that the application output that ...
ackbar03's user avatar
2 votes
1 answer
390 views

Finding the correct input of an executable to print out the flag. IDA 7

I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions): .text:00C21034 Buf= byte ptr -...
Elyasaf755's user avatar
0 votes
0 answers
132 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
Mery Ted's user avatar
  • 232
0 votes
1 answer
2k views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
Mery Ted's user avatar
  • 232
3 votes
0 answers
161 views

Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
eXp's user avatar
  • 111
2 votes
1 answer
925 views

Reverse getline(cin, text)

I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse: ...
unc4nny's user avatar
  • 79
0 votes
2 answers
86 views

Figuring out correct user input key from final key + generated buffer

I've recently gotten into reversing crackmes, and I seem to always fail at the ones similar to this. The final key that the program uses for comparison is not the key that should be used as input, ...
user avatar
3 votes
2 answers
1k views

In reverse engineering, what does it mean to "patch a file"?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
unc4nny's user avatar
  • 79
6 votes
2 answers
8k views

Can I trap SIGSEGV (on a Linux) and what are are the conditions to make it works? (for a crackme)

I'm writing some crackmes.one challenge and I want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way to segfault. It should ...
ker2x's user avatar
  • 173
1 vote
1 answer
1k views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
RS Gamer's user avatar
0 votes
0 answers
3k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
RS Gamer's user avatar
1 vote
0 answers
265 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
programmersn's user avatar
0 votes
2 answers
297 views

crackme disassembly - are these local variables ever initialized?

I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
ch-pub's user avatar
  • 103
1 vote
0 answers
280 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
Mofro's user avatar
  • 23
3 votes
1 answer
11k views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
Anonymous's user avatar
  • 221
2 votes
1 answer
765 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
Anonymous's user avatar
  • 221
3 votes
2 answers
2k views

Are there any crackme sites made for cheat engine or to practice game hacking particularly?

I've checked several crack me sites and they're all on reverse engineering applications. However, I would like to practice reverse engineering by manipulating game values. The cheat engine tool ...
Mugen's user avatar
  • 133
1 vote
0 answers
159 views

Looking for crackme with full solutions [duplicate]

There are lot of crack me site. I looking for site that have lot of hard crack me/ malware to research anti debug/anti vm... but with full solution
Keystone's user avatar
  • 523
3 votes
1 answer
430 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
AqueleCaraComNome's user avatar
0 votes
2 answers
606 views

Automating a crackme solving process

Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
robert's user avatar
  • 887
1 vote
2 answers
608 views

How to reach functions triggered by non-standard buttons?

I've already read related posts such as: link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg link2: How can I set a breakpoint for a button ...
BPL's user avatar
  • 99
0 votes
1 answer
121 views

Keygenme - Key location

So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction: ...
Trey's user avatar
  • 417
2 votes
2 answers
694 views

How can I reverse this recursive function?

This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does. def the_process(stored, inp, size): idx = 0 ...
rk4iz's user avatar
  • 23
1 vote
1 answer
195 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
jame's user avatar
  • 111
-1 votes
1 answer
269 views

What is a "goodboy/badboy" [closed]

I'm confused and I'm trying to follow the Radare 2 Crackme Challanges. In it, they say, This seems to be a goodboy/badboy. Is a "goodboy/badboy" lingo for a specific thing, and if so what?
Evan Carroll's user avatar
  • 1,779
0 votes
1 answer
283 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
Tigre's user avatar
  • 3