Hot answers tagged

21

Here are a bunch: https://pwnable.xyz/ https://crackmes.one https://tuts4you.com/download.php?list.17 https://github.com/fdivrp/awesome-reversing/ https://github.com/michalmalik/linux-re-101 https://tuts4you.com/download.php http://jackson.thuraisamy.me/re-resources.html https://github.com/RPISEC/MBE https://github.com/Maijin/Workshop2015/tree/master/IOLI-...


13

A good way to quickly find if a function f() has an inverse or not, is trying to find two elements of the initial domain x and y such that x!=y and f(x)==f(y). If such couple of elements exist, you cannot distinguish them in the target domain of f and, thus, a reverse function cannot be built. Looking at your example: f(x) = x^(x>>11), we can split ...


8

Perror already covered this particular case, but here are some general principles for inverting similar functions. Note: all of this assumes the integer is either unsigned, or it is signed using two's complement and using unsigned shifts. In Java, two's complement is guaranteed. In C/C++, it is not guaranteed, but it's almost always the case in practice, ...


7

Also you should check http://crackmes.de/ They have a huge list that you can sort by difficulty.


7

I wrote some articles (search for radare2) about using r2 for crackmes, and there is a talk section on the official website. Also you can find useful articles from the blog. Also, feel free to come ask questions on the irc channel.


7

First of all, the fact to turn a program into a bytecode that will be interpreted by a crafted VM which will be embedded into the software is a quite well-known technique of obfuscation. There have been numerous writings about it. If you want to find good pointers about it (and how to solve it in different ways), I would advise you to search for "VM-based ...


6

If you have very little experience in binary RE I would suggest to start with preparing for a lot of unknown information that would be "thrown" on you, time and patience :-). Now to the subject. To do the work your are talking about, you'll need tools and you need to know them well: Olly - to do the dynamic analysis of the binary. The one you already have ...


6

open an account if you don't already have at forum.tuts4you.com, then browse to http://forum.tuts4you.com/forum/37-crackmes-unpackmes-keygenmes/ I believe that you will find many that you will like.


6

https://dilsec.wordpress.com/2017/07/06/google-ctf-2017-pwnables-inst_prof-writeup/ (Google CTF Writeup) https://www.cs.ucsb.edu/~chris/teaching/cs290/projects/proj4.html (see Challenge 4 ) https://www.fireeye.com/blog/threat-research/2015/07/announcing_the_secon.html (FLARE) https://cedricvb.be/post/reverse-engineering-the-hitb-binary-100-ctf-challenge/ (...


5

Short, slightly snarky answer: yes, there must be a way to make a keygen. If there wasn't, the creators of the software themselves wouldn't be able to create keys to sell. Longer answer: If the software vendor wants the encryption to be non-identifiable for people who have reversed the decryption part, they need to use some assymetric key algorithm, where ...


5

Have a look at R4ndom's Tutorial #17 on working with Delphi binaries and cracking them: http://thelegendofrandom.com/blog/archives/1472 He describes how you can use Resource Hacker (I prefer XN Resource Editor) to find the event handler for the form that calls the dialog you are looking for. With knowledge of the form you are interested in, download DeDe ...


5

I try to give a very superficial answer for your question because I am quite sure that there are other treatments for this problem. Mathematically, the function f(y) = y^(y >> 11) is invertible in the sense that the left-inversion, namely a function g so that y = g(f(y)) exists, because f is an injective function. However that does not mean we can ...


4

I think this is what you are looking for: https://github.com/maijin/workshop2015 And of course just join the chat room on freenode #radare2 and ask questions.


4

You should take a look at crackmes.de, especially level 6, like this one, or this one.


4

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of things, but it doesn't have any known magic bytes at the beginning and doesn't appear to belong to any commonly known file type. Your best bet with getting ...


4

Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function. #include <Windows.h> typedef DWORD (__cdecl *_GetFlag)(); _GetFlag GetFlag; HMODULE hDll = NULL; NTSTATUS main(int argc, char **argv) { hDll = LoadLibrary("my_head_flew_away_patched.dll"); GetFlag = (...


4

The "good boy" is the thing that lets you know you were successful in your cracking/patching. The "bad boy" is the thing that lets you know you're unsuccessful. In a commercial app, a "good boy" would be akin to a message box saying, "Thank you for entering a valid license! You're now fully registered." Whereas the "bad boy" would be the message box that ...


4

I gave it a go. First I simplified your code a little bit. def the_process(stored, inp, size): global thstr idx = 0 idx = stored.index(inp[0]) if idx: the_process(stored[:idx], inp[1:], idx) if size - 1 != idx: the_process(stored[idx+1:],inp[idx+1:], size - idx - 1) thstr.append(inp[0]) Now it looks like by the ...


4

The cmp instruction does not multiply anything by two. Instead, the piece of code seen in your ollydbg screen shot is the implementation of the following line from the poor quality source code image you attached: if ((!key) || (key > (0x1337 * 2000))) First, in address 0x01051C09, key is compared to 0. If key equals 0 a jump to 0x01051C18 is taken. ...


3

Since it is a crackme, I don't want to spoiler the solution, although I try to give some hint, which may help you. The hash function may be MD5 using salt, modified IV or the hash function is used in a different way as you try. However, you neither have to reverse the hash function nor have to find out the exact algorithm. It is because, the crackme ...


3

Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.


3

The first thing with radare2 is to make sure that you're running the latest git version. To get help about commands in radare2, you can use the ? character. For help about configuration variables, you can use e?? (since e? would give you help about how to use them, not list them). Since there are many variables, you can filter them with the internal grep ...


3

We can define recursive functions in SMT language (e.g. with define-fun-rec), but some popular solvers (e.g. z3) currently cannot handle them yet (I do not know any can support); so it is not direct to encode loops in such a solver. But we can use a trick, that is to just unroll the loop (then it is still obliged to test several lengths of the password) by ...


3

We collect useful links about using radare2 on our forum (jvoisin blog too :) )


3

I assume your friend did not utilize tricks like anti-debugging and packing the binary, as your first challenge. Assuming is not right for an answer, so you should provide more details next time :) How I would approach this: Go trough Lena's tutorials. Identify what is the application was written in. There are multiple tools for this, such as : PEID or ...


3

This is probably P-code compiled file, not native code. Try WKT Debugger: http://www.woodmann.com/collaborative/tools/index.php/Whiskey_Kon_Tequilla_VB_P-Code_Debugger


3

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=XaWtoCmOGpw#t=1m40s


3

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. However, Today I would recommend Telerik's JustDecompile though as it has built in de-obfuscation (de4dot) and has an option to replace a section with code which is ...


3

The reason for your observation is an overflow in the sscanf call that is done in the function checking if the number is even or odd. While the check for your 9-character password succeeds the 10-character password produces an overflow and the check fails. To verify, compile and run the following C code: #include <stdio.h> #include <stdlib.h> ...


Only top voted, non community-wiki answers of a minimum length are eligible