RodrigoTeixeira's Very easy disassembly execise

Download here: https://crackmes.one/crackme/68a346c48fac2855fe6fb6df
MD5: 8483be5dfef09fb44dd14cec54c56a80
SHA1: fe71c366051bbe25e0e755b92008364ab149f474
SHA256: 72cb9e317be02bd73b93e80de9f07d29234948e09bf658058691460e504f0d4c

This is listed as a C/C++ x64 executable with a difficulty rating of 1.0. The author is RodrigoTeixeira and the executable is written for Windows.

The authors description:

Retreive a hard coded int from the executable. Good luck.

I'm not feeling well today but my goal for the month is to solve a crackme everyday so I chose an easy one to knock out.

The description lists this as an x64 application but DIE tells us that it's actually x86. It does not appear to be packed. The author used MingGW to compile the console application.


Taking a look at the strings we can see what can be assumed to be the prompt and good boy. We also get an indication that the author may have compiled the executable using Cygwin. Their real name might be Keith.


Detect it easy found signatures that caused it to determine that this was written using C/C++ but I think it may have been written using ASM. It's extremely bare. The defaults make it clear what the password should be. The initial prompt is referenced using .rdata. There isn't even a prompt to let you know that you entered the incorrect password.

The way arguments are being passed to functions is also really strange. The stack space is being allocated up front and then different arguments are being move directly to the top of the stack. But anyways.

Here's my edited version.


Thank you to the creator for the challenge. If you happen to find this, could you let me know if I'm correct that this was written in assembly.

Comments

Post a Comment

Popular posts from this blog

Crackme: atherusti's First C program

Image
Download here: https://crackmes.one/crackme/68c96889224c0ec5dcedc063 MD5: fdb187c953ae9e0e98e18b1fc0683ef1 SHA1: e1f4f4a1e0629ba38cfa567c45cbee6092aabf0a SHA256: 03832f7e8e8fdfd6ee87ef4efb3eab52252edbfe246c9d2bfdd39166a27c9e30 This is listed as a C/C++ x64 executable with a difficulty rating of 2.0. The author is atherusti and the executable is written for Windows. The authors description: never coded before making this crackme, get the password That's a really interesting first programming project but I'm all for it. Let's tear this bad boy apart and see how they did. The first thing that immediately jumps out to me is seeing that it is actually an x86 executable. No big deal but its something to keep in mind. Our calling conventions are going to change. I also don't expect to see a shadow stack. One final note, this is a console application. Taking a look at the string entries doesn't really reveal anything. I find that a little strange. They must be encoded/encry...
Read more

Crackme: antilagvip's medium crackme

Image
Download here: https://crackmes.one/crackme/68e6377b2d267f28f69b7447 MD5: 406af7cd43808f1de221d36d8c7d12d6 SHA1:  736c3fee49a93c60731a2f137545b75311646f9f SHA256: 588211672f26f28731da0d30f2691f23542ea7a825f553a5edc9087dbf52b86e This is listed as a C/C++ x64 executable with a difficulty rating of 3.0. The author is antilagvip and the executable is written for Windows.   The authors description: the right key get the code.. sounds simple right?   This was a fun challenge. I went through the motions. I loaded this in Detect it Easy. It isn't packed. It's a console application. Strings aren't encoded/encrypted. I also loaded it into PE Bear and just looked around. Nothing interesting jumped out at me.   I've talked about how to find the main function in previous posts so I'm just going jump in and say that it is located at 0x140001180. Pretty basic stuff, it prompts you for a key and waits for input. It calls a function that validates whether your key is valid and ...
Read more

Crackme: Meist's Passfind Crackme

Image
  Today we're going to be solving "meist's passfind" crackme. It is described as the most easy crackme that the author could come up with. One simply needs to find the password and enter it. Great! Available here: https://crackmes.one/crackme/68be3593224c0ec5dcedbe2d MD5: f7215afaac27af81c31362fe09b0e17d SHA1: f4fbe3a9d2afad8cf4b31aac2b5fe308d0d1e3f8 SHA256:  752ed87f3783e8ba14f1585152a6abf4f8e174ca3635b705a7a9c0f88b6405e5 Running Detect it Easy, we can see that the executable is compiled as an x64 PE console application but we're unable to determine what compiler was used or what language it was written in. Taking a look at the strings, it's possible that this was compiled using the mingw compiler and possibly written in assembly. That would explain why DIE had so little information on the binary.   Dropping the executable in Ghidra and running all the defaults, we're greeted with this:   Let's take this step by step. I took a look inside of the __mai...
Read more