klizma — crackme1_lucky

Introduction

Language: C/C++

Platform: Windows

Arch: x32

VirusTotal: N/A

Crackmes.one: https://crackmes.one/crackme/5ab77f5733c5d40ad448c37c

Debugging/Reversing

Wow, got a really nice crackMe today, what is nice with it is that it is packed! yeah!

Alright, I got a crackMe

Its description says:

So we know it is packed and we cannot see the strings directly so either we need to unpack it manually or with tools (by using tools, first we need to understand what packer is used and hope that it has unpacker in the internet).

I just get one of my old friend to check its packer to make sure that is packed.

As we can see, it is packed with “FSG” so we can find its unpacker easily but I would like deep dive to assembly code and try to manage this with breakpoints :) and we should never forget that if it executes and it unpacks itself so I trust that I will try to let it run for a while and then try to find the strings which we need!

Ok, let’s load this…

Initially I can see some strings like “Good! write tutorial!” but we cannot really find it as it is in packed code, let’s let program to run a bit.

Ok, I ran it and I typed a random numbers (must be 6 digits as program asks that). Right before pressing the enter button, I just stop running the exe and from there I just use step into/over buttons.

why I led it to run till “Your serial”? well because I also could not find this string in my search so if it shows this string then it can mean that the packed code is unpacked now.

now, we can navigate to Symbols tab and double click on our exe in the list as below:

Now, we are in crackme.exe and can scroll down to see unpacked code.

Boom!

This is what we are looking for! let’s put a breakpoint right after our “scanf” function and run!

Of course, execution will hit our breakpoint. Everything is fine, we know where we are storing our entered key but where is other string, actual key to compare!

hmm, I see a function call, let’s step into that!

as we can see this function is very long, seems it does a lot calculation! do we care about calculation? basically yes as we have a comparison right after this function call so it compares with one (1) and if it does not match then it shows “Not valid, Try again!” message which we do not want to see!

So I was debugging then I see a value is being set at the beginning of the function of course, I just converted it to decimal from hexadecimal and boom! I got the right key!

F423F is actually 999999 — I still don’t know what does that long function… :)

We can also patch it by changing 0x1 to 0x0 :)

Conclusion

Thanks to writer as we had something different and fun!

REv3rs3Th3P14n3t