Questions tagged [crackme]

Little Puzzle Applications for Reverse Code Engineers, with the goal to break a protection scheme legally for exercise. These often have a lot of built-in security to prevent attackers from succeeding, at the end the reverse engineer often writes a so-called keygen (key generator) and a paper to show s/he succeeded and how.

Filter by
Sorted by
Tagged with
2
votes
2answers
123 views

In reverse engineering, what does it mean to “patch a file”?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
0
votes
0answers
38 views

How To Unpack DTprotect V-1.x (VMprotect) [on hold]

I have a program that packed with DTprotect V-1.x which based on VMprotect. DTprotect is desined by a chinese company. The packed system just recognise by RDGPackerDetector and i can't find any ...
4
votes
2answers
105 views

Can i trap SIGSEGV (on a linux) and what are are the conditions to make it works ? (for a crackme)

Friendly greetings ! I'm writing some crackmes.one challenge and i want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way ...
1
vote
0answers
66 views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
1
vote
0answers
111 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
0
votes
0answers
97 views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
0
votes
2answers
115 views

crackme disassembly - are these local variables ever initialized?

I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
5
votes
1answer
5k views

Fixing corrupt ELF header field “e_shnum” for use in GDB

If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
1
vote
0answers
113 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
2
votes
2answers
292 views

Are there any crackme sites made for cheat engine or to practice game hacking particularly?

I've checked several crack me sites and they're all on reverse engineering applications. However, I would like to practice reverse engineering by manipulating game values. The cheat engine tool ...
2
votes
1answer
106 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
0
votes
1answer
935 views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
1
vote
0answers
61 views

Looking for crackme with full solutions [duplicate]

There are lot of crack me site. I looking for site that have lot of hard crack me/ malware to research anti debug/anti vm... but with full solution
13
votes
2answers
19k views

Crack Me Material

I'd like to get started with reverse engineering. Some years ago I've seen many many program, so called "crack mes" to crack. When I searched for some this week I've found none. My Question is, can ...
4
votes
3answers
10k views

Edit codes in .Net Reflector with Reflexil (Compile Window)

I'm Using .Net Reflector with Reflexil to edit or view .net Assembly codes. I see this picture in reflexil.net: It Shows the "Compile" window. How can I see this window and edit codes?
3
votes
1answer
181 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
0
votes
2answers
195 views

Automating a crackme solving process

Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
2
votes
2answers
345 views

How can I reverse this recursive function?

This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does. def the_process(stored, inp, size): idx = 0 ...
1
vote
2answers
145 views

How to reach functions triggered by non-standard buttons?

I've already read related posts such as: link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg link2: How can I set a breakpoint for a button ...
0
votes
1answer
91 views

Keygenme - Key location

So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction: ...
1
vote
1answer
263 views

Solving method of DLL crackme

I was given two DLL files (link) . The task is to get the flag from them. First what I've done - opened the first file (called original) in IDA and found the function called _GetFlag. As I understood,...
1
vote
1answer
112 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
-1
votes
1answer
154 views

What is a “goodboy/badboy” [closed]

I'm confused and I'm trying to follow the Radare 2 Crackme Challanges. In it, they say, This seems to be a goodboy/badboy. Is a "goodboy/badboy" lingo for a specific thing, and if so what?
0
votes
1answer
161 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
0answers
586 views

crackme binary crashing on Raspberry pi

I was trying out a basic ARM crackme here. Upon running it on my Raspberry pi, it segfaults without giving me any warning. Moreover, I'm unable to set breakpoints anywhere(even on the entry point). Is ...
0
votes
1answer
360 views

brute force remote nop sled memory address

I am in the middle of a binary crackme (ELF-64) on a remote server which communicates via simple socket server in C. I have the source code, locally. After overflowing the buffer (socket buffer is ...
1
vote
1answer
822 views

AT&T XOR argument at radare2

Recently I faced with strange (in my opinion) behavior of radare2. I have been reading the Artificial truth blog post about Hacking bits with this crackme. In an article Julien used Intel syntax, ...
1
vote
1answer
684 views

Reverse engineering of Managed C++/C# CrackMe

I'm reverse engineering the CrackMe which is written on Managed C++/C#. Arguments are "string" (email in this case) and "serial". Serial is somehow depends on string and I need to understand how. I ...
3
votes
1answer
151 views

Weird looking assembly-code bunch

I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls): 0040E978 . 53 ...
5
votes
1answer
950 views

Reverse engineering the virtual machine based crackme

I am currently working on some crackme, that has implemented an obfuscation technique, virtualisation. The virtual machine inside this crackme is a huge switch-case block (over 130 cases in it). I ...
-1
votes
1answer
280 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
2
votes
2answers
1k views

Help with IOLI crackme0x02

I am studying IOLI crackme0x02. It is clear to me that rewriting the jump at 0x8048451 with no instructions the crackme can be patched. However, I want to understand better what the code does. My ...
1
vote
1answer
148 views

Length requirement on IOLI crackme input

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all ...
0
votes
2answers
553 views

c++ version of MOV AL,BYTE PTR DS:[ESI]

I'm writing a keygen for a crack-me exercise. I have a problem with handling byte assignments the crack-me performs several times using instructions like MOV AL,BYTE PTR DS:[ESI] (move byte from ...
-1
votes
1answer
652 views

How to crack windowed crackmes?

I am starting with reverse engineering/cracking with advanced knowledge about programming and functioning of the operating system and I saw a whole series of lena151 Lenas Reversing for Newbies but I ...
0
votes
1answer
82 views

Where can I get systematic problems and solutions for debugging?

I know PEFile headers, assembly language, and other basic stuff. I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language. ...
2
votes
1answer
1k views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
-2
votes
1answer
9k views

Where can I find CrackMes for beginners? [closed]

I'm interested in learning. Where can I find CrackMes for beginners? Especially ones with answers.
1
vote
1answer
619 views

Decrypt / Decode / Decompress Proprietary File

I am using a 3rd party software that stores templates for ID cards in a database. I believe the templates are in xml format but are encrypted / encoded / compressed in the database. Each encoded ...
0
votes
1answer
826 views

How does serial number is checked in this crackme?

I am trying to reverse engineer a crackme exe. I have managed to find the function that checks serial number based on email input. So, 4 arguments are pushed to the stack (esp) which are the input ...
4
votes
4answers
4k views

Use OllyDbg to identify what happens when a button is pressed

I am entirely new to reverse engineering, but nonetheless I have been given the challenge by a friend to crack a computer program he wrote. Having never done this before, my research online suggested ...
1
vote
1answer
629 views

What are the results of this sbb instruction?

I'm doing a crackme to learn some reversing, and I stumbled upon this code generated by C++ MFC: sbb eax, eax sbb eax, -1 test eax, eax jz exit Before that code a comparison is done, such as cmp al, ...
5
votes
3answers
718 views

Any documentation available for r2 other than official book

I am interested in learning and using radare2 as a toolset for reverse engineering. But I want ANY other resource for learning this tools other than radare2 book, preferably a video series. What I am ...
0
votes
1answer
170 views

Can a keygen be created for this protection algorithm? [closed]

I reverse engineered a program protection algorithm and got the result in this source file I wrote, but I would know this type of protection. Please tell me what is the type of this protection ? And ...
1
vote
2answers
781 views

Extract decrypted token from EXE

EDIT As some people have pointed out, this exe file classifies as a 'virus' on some analysers. I can assure you this exe is from a very trusted source, and is actually part of a large puzzle (which ...
4
votes
2answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
0
votes
4answers
3k views

Where to find a hard crackme [closed]

I'd like to improve my skill as a reverse engineer. And thus I am looking for a location to find these.
1
vote
3answers
789 views

How to break this reversing exercise

I have reversed the code of this simple crackme(more like reverseme :)) but I don't understand how to create valid password for the algorithm. Here's the reversed code: #include <stdlib.h> #...
0
votes
0answers
361 views

How to find a verification routine that enables a button and a textbox [duplicate]

I have an app (reverseme) that looks like calc.exe. It has 9 number btns, clear and enter buttons. The enter is disabled. There is another input textbox without any enter or submit button. It takes ...
4
votes
1answer
366 views

Which virtualized target is recommended for newbie on vm-obfuscation?

I'm newbie on virtualized code obfuscation. I can break many features to avoid debugging/reversing and packer/protector (even Themida, without vm option), but I'm not good at virtualized code. Though ...