Posts

Showing posts with the label anti-debugging

crackme: Bobx's Very hard antidebug +10 antisystem

Image
Download here:  https://crackmes.one/crackme/690cdb672d267f28f69b7bbf MD5: df7d6763f43a35b50065b558348f6e65 SHA1: 9e9faabd7bd09a04cf620fde52f6f8a77890053e SHA256: 2d192e5dd555176eb43868d5117fa98885f102f0ac9c8a1964a6c35f63080464 This is listed as a C/C++ x64 executable with a difficulty rating of 3.0. The author is Bobx and the executable is written for Windows. The authors description:  Good Luck and Have A Lot Of Fun ;) When you load the executable in Ghidra, you can very clearly see what is going on.    Let's take a look at the ValidatePassword function. A buffer is passed to the GetPassword function and then our input is compared against it. If they match, the function returns true, otherwise it returns false.   Let's see what the GetPassword function looks like. Hmm, it looks like mistakes were made. We can essentially ignore everything except the last 5 lines of code. The correct password buffer is very clearly getting loaded with a hardcoded string. This...

Keygenme: duckzzy's KeygenMe

Image
Download here:  https://crackmes.one/crackme/68baa4348fac2855fe6fbb18 MD5: bb20f4ae2a79145210d164691ac7a481 SHA1: c13928fc9e65b37a6debd67e3f398614943e9fa4 SHA256: 72cfda0045fdf90e5a7965dd76690bba473e4dd87c86ff11a46704f1930d9ff7  This is listed as a C/C++ x64 executable with a difficulty rating of 2.0. The author is duckzzy and the executable is written for Windows. The authors description: Good luck! :)   I decided to tackle this keygenme today to hopefully help someone out. In the crackmes.one discord server, a user by the name of British_UK was having some issues solving this challenge so I thought I'd give it a shot.   So without further-ado, lets get this loaded in DIE and see what we can learn. First thing that jumps out at me is the high number of sections. Das weird. Its doesn't appear to be packed though. Finally, it is a console application.   The strings don't appear to be encoded/encrypted/obfuscated/choose latest buzzword here. It appears as though ...

Crackme: git's simple crackme medium-hard

Image
Download here: https://crackmes.one/crackme/68e2b4652d267f28f69b738e MD5: 49c66031be227cc5982daadfd7368e9d SHA1: 0f01dfd5c1775dd7b605c992903d67bbafa3051f SHA256: 67b06c9c003f0c26c319d82b1fc6436207eaf0e3ed31f438312be8349225272f This is listed as a C/C++ x64 executable with a difficulty rating of 2.5. The author is git and the executable is written for Windows. The authors description: medium-hard crackme with antidebug checks obfuscated strings and key With this crack me, I'm going to take a bit of a different approach. I'm not going to use a decompiler. Taking a look at the strings, I can see some base64 encoded strings. Other than that, Detect it Easy believes this was compiled using Visual Studio 2022 as a console application. It does not appear to be packed. IDA shows us a long series of various debugger checks. At this point, I will manually step through the code and navigate the executable to the good boy. The base64 decode function takes the encoded string and a buffer a...

Crackme: LAG's crack me test

Image
Download here: https://crackmes.one/crackme/68c8f641224c0ec5dcedc044 MD5: c73e472c7762fce291af0aec40bc67be Sha1: 22adcf120b680d8cb916de201b272c12c4aef6fa Sha256: d7e62af3e23649224c6d9481deab9bef13de041eafb243098f41e1a008335376 This is listed as C/C++ x64 executable with a difficulty rating of 2.2. The author is LAG and the executable is written for Windows. The authors description: this is a file I've worked on for a couple of hours i'm just wanting to see how well my security is I couldn't crack it myself so if you guys can good job and I've probably done a really bad job but just wonder if anybody could do it it should be pretty hard but I could be wrong it's just a simple password thing you have to put the password in and if you get it right it sounds good If you fire up Detect it Easy and analyze the executable, everything checks out. Note that this is a console application. Taking a look at the strings, we can begin to make some assumptions. We can assume that ...