Hot answers tagged

43 votes
Accepted

Crack Me Material

Here are a bunch: https://www.wechall.net/active_sites http://www.wechall.net/challs/ https://crackmes.one https://pwnable.xyz/ https://tuts4you.com/download.php?list.17 https://github.com/...
12 votes

Crack Me Material

https://dilsec.wordpress.com/2017/07/06/google-ctf-2017-pwnables-inst_prof-writeup/ (Google CTF Writeup) https://www.cs.ucsb.edu/~chris/teaching/cs290/projects/proj4.html (see Challenge 4 ) https://...
knx's user avatar
  • 1,257
11 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
Megabeets's user avatar
  • 8,959
10 votes
Accepted

Reverse engineering the virtual machine based crackme

First of all, the fact to turn a program into a bytecode that will be interpreted by a crafted VM which will be embedded into the software is a quite well-known technique of obfuscation. There have ...
perror's user avatar
  • 19k
6 votes

Debugging forked child in an anti-debug protected crackme

Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.
pancake's user avatar
  • 482
5 votes
Accepted

Weird function names in disassembly (crackmes)

Those are C++ mangled names. Some tools like Ghidra will automatically demangle them for you. If you want to see what the function should be named try: c++filt ...
Melody's user avatar
  • 66
4 votes
Accepted

Can a keygen be created for this protection algorithm?

Short, slightly snarky answer: yes, there must be a way to make a keygen. If there wasn't, the creators of the software themselves wouldn't be able to create keys to sell. Longer answer: If the ...
Guntram Blohm's user avatar
4 votes

Debugging forked child in an anti-debug protected crackme

The first thing with radare2 is to make sure that you're running the latest git version. To get help about commands in radare2, you can use the ? character. For help about configuration variables, ...
jvoisin's user avatar
  • 2,516
4 votes

Decrypt / Decode / Decompress Proprietary File

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of ...
Gogeta70's user avatar
  • 171
4 votes
Accepted

Solving method of DLL crackme

Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function. #include <Windows.h> typedef DWORD (__cdecl *_GetFlag)();...
sudhackar's user avatar
  • 2,639
4 votes

What is a "goodboy/badboy"

The "good boy" is the thing that lets you know you were successful in your cracking/patching. The "bad boy" is the thing that lets you know you're unsuccessful. In a commercial app, a "good boy" ...
dsasmblr's user avatar
  • 2,234
4 votes
Accepted

How can I reverse this recursive function?

I gave it a go. First I simplified your code a little bit. def the_process(stored, inp, size): global thstr idx = 0 idx = stored.index(inp[0]) if idx: the_process(stored[:idx],...
sudhackar's user avatar
  • 2,639
4 votes
Accepted

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

The cmp instruction does not multiply anything by two. Instead, the piece of code seen in your ollydbg screen shot is the implementation of the following line from the poor quality source code image ...
NirIzr's user avatar
  • 11.8k
3 votes

Crack Me Material

Although this is an old posting, I would like to add a long-standing still active site with great challenges (sometimes pretty pretty hard, in the higher levels): https://overthewire.org/wargames/
josh's user avatar
  • 1,964
3 votes
Accepted

Extract decrypted token from EXE

Since it is a crackme, I don't want to spoiler the solution, although I try to give some hint, which may help you. The hash function may be MD5 using salt, modified IV or the hash function is used in ...
ebux's user avatar
  • 1,759
3 votes

Length requirement on IOLI crackme input

The reason for your observation is an overflow in the sscanf call that is done in the function checking if the number is even or odd. While the check for your 9-character password succeeds the 10-...
bns's user avatar
  • 31
3 votes
Accepted

brute force remote nop sled memory address

Brute force is not the way you should look to in anything unless its your last resort. The address space of x64 is too large to get brute force to work. Look up on this technique called ROP(Return ...
sudhackar's user avatar
  • 2,639
3 votes
Accepted

Weird looking assembly-code bunch

If you follow the flow, you will see that the result of the first "lea ebx, []" is replaced by the result of the "lea ebx, []", with no intervening use of ebx. While they can serve a meaningful ...
peter ferrie's user avatar
  • 4,699
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. ...
Remko's user avatar
  • 3,218
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=...
Jason Geffner's user avatar
3 votes

Any documentation available for r2 other than official book

We collect useful links about using radare2 on our forum (jvoisin blog too :) )
dukeBarman's user avatar
3 votes
Accepted

Fixing corrupt ELF header field "e_shnum" for use in GDB

In this particular case, repairing the header can be automated. Since the section header string table is present, the original value of e_shnum can be found by counting the number of strings in the ...
julian's user avatar
  • 7,118
3 votes
Accepted

Keygenme - Key location

Use a global or static variable. Explanation: EBP (base pointer) typically holds the address of the current stack frame, in that case it's used to get the address to local variable. (reference) ...
user202729's user avatar
3 votes
Accepted

crackme disassembly - are these local variables ever initialized?

Yes, they are initialized, albeit indirectly. Have a look at this fragment: 0x00401189 488d45fb lea rax, qword [local_5h] 0x0040118d be05000000 mov esi, 5 0x00401192 ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

Can I trap SIGSEGV (on a Linux) and what are are the conditions to make it works? (for a crackme)

A solution working in Windows was given in my question - this way, you can cause program to continue after it receives SIGSEGV. You can do similar thing on linux (though I would recommend using ...
bart1e's user avatar
  • 3,369
3 votes

In reverse engineering, what does it mean to "patch a file"?

Following quote comes from unix.stackexchange: To patch a file means to modify it, with the connotation that the modification is generally small. So, patching the executable is a process of ...
bart1e's user avatar
  • 3,369
3 votes

Reverse getline(cin, text)

use print &text or use info locals :\>dir /b & type cin.cpp & g++ -g cin.cpp & echo ========= & gdb -q a.exe cin.cpp #include <iostream> #include <string> using ...
blabb's user avatar
  • 16.3k
3 votes
Accepted

A Process does not list on x64dbg attach list

x64dbg comes in two versions, 32 and 64 bits. You need to run the 32-bit version of x64dbg to detect a 32-bit application.
Abdullah Mohamed's user avatar
2 votes

Fixing corrupt ELF header field "e_shnum" for use in GDB

I recreated your binary and then used Radare to corrupt the header exactly as you did, changing the number of section headers to 52. r2 -w a.out -1c's 0; pfo elf64; .pf.elf_header.shnum=52' This ...
Evan Carroll's user avatar
  • 1,779

Only top scored, non community-wiki answers of a minimum length are eligible