| View previous topic :: View next topic | 
	
  | 
 
	  
		| How would you rate this crackme? |  
		| 
			
			  | Easy, Took me less than .024 seconds |  | 83% | [ 5 ] |  
			  | Decient, like any other crackme |  | 16% | [ 1 ] |  
			  | Hard, Took me awhile but I finally cracked it! |  | 0% | [ 0 ] |  
			  | Impossible!, The password is never the same you cheater! |  | 0% | [ 0 ] |  
			  | Who cares? |  | 0% | [ 0 ] |  |  
		| Total Votes : 6 |  
 | 
	
		| Author | Message | 
	
		| sumnewdude Expert Cheater
 
 ![]() Reputation: 0 
 Joined: 23 May 2007
 Posts: 181
 Location: Where you least expect me.
 
 | 
			
				|  Posted: Fri Jun 06, 2008 11:22 am    Post subject: Crackme V5 |   |  
				| 
 |  
				| Hey guys its me again with my Fifth version of my crackme's. This crackme should be the hardest. (emphasis on "should"). 
 OBJECTIVES
 1.Crack it and post a picture of it cracked.
 2.If you didn't crack it by finding a "ID" and "PW" do so and post the ID and PW
 3.Find the (not so) Hidden messages . . . there are from 5 to 10
 (you might have to decript some/rearange letters)
 4.Explane how you did all of this.
 5.Have fun? I really don't know how to make "Fun" crackme's soooo.
 
 (P.S. My Crackme only uses typable letters for Password)
 
 Its been a week how is it going? It seems like everyone is dead on the Crack me fourm. Are yall all right?
 Credit to coder sal for "hidden messages" idea
 _________________
 
   .erutangis ruoy ni siht esu neht ,sdrawkcab siht daer ot hguone trams erew uoy fI
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| gmaster1440 Master Cheater
 
  Reputation: 0 
 Joined: 26 Jun 2006
 Posts: 365
 Location: a,b,c++
 
 | 
			
				|  Posted: Tue Jul 08, 2008 6:11 pm    Post subject: |   |  
				| 
 |  
				| Holy crap I wonder how long this string could possibally be?. . . . . . . . .So how many messages have you found?....HI iIIiiiiIIIIIiIiIii1111111on 
 
  	  | Code: |  	  | 00402F5C   . 6600 6900 2000>UNICODE "fi uoy n" 00402F6C   . 6100 6300 2000>UNICODE "ac daer "
 00402F7C   . 7300 6900 6800>UNICODE "siht uoy"
 00402F8C   . 2000 6500 7200>UNICODE " era del"
 00402F9C   . 6C00 6900 6B00>UNICODE "liks",0
 
 
 | 
 
 
 
  	  | Code: |  	  | 004030D4   . 4300 6F00 6E00>UNICODE "Conratuj" 004030E4   . 6C00 6100 7400>UNICODE "lations!"
 004030F4   . 2100 2100 2100>UNICODE "!!!! I c"
 00403104   . 6100 6E00 2700>UNICODE "an't spe"
 00403114   . 6C00 6C00 2100>UNICODE "ll!",0
 
 
 | 
 
 
  	  | Code: |  	  | 00403194   . 4300 6F00 6E00>UNICODE "Congratu" 004031A4   . 6C00 6100 7400>UNICODE "lations!"
 004031B4   . 2C00 2000 5900>UNICODE ", You ha"
 004031C4   . 7600 6500 2000>UNICODE "ve crack"
 004031D4   . 6500 6400 2000>UNICODE "ed me!",0
 
 
 | 
 
 
 thats what i got so far...
 _________________
 
 c++ pointers... |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| himpula How do I cheat?
 
 ![]() Reputation: 0 
 Joined: 26 Dec 2007
 Posts: 5
 
 
 | 
			
				|  Posted: Wed Jul 16, 2008 6:12 pm    Post subject: |   |  
				| 
 |  
				| Use 123 as name and pass. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| atom0s Moderator
 
  Reputation: 205 
 Joined: 25 Jan 2006
 Posts: 8587
 Location: 127.0.0.1
 
 | 
			
				|  Posted: Sun Jul 20, 2008 1:52 pm    Post subject: |   |  
				| 
 |  
				|  	  | himpula wrote: |  	  | Use 123 as name and pass. | 
 
 All you did was patch the bad message to display the good one. That really isn't cracking it.
 
 Not sure if this is the correct congrats but:
 
 "Conratujlation!!! I can't spell!"
 
 Method of obtaining this screen:
 
 Enter anything for the name and the pass. In olly break here:
 
 
  	  | Code: |  	  | 00403BF5   /0F84 37470000   JE a.00408332 | 
 
 This line is for the length compare. (Just be sure to enter something longish to get it to pass this, no need to patch it.)
 
 The next part is a few additions and compares. I didn't bother digging into this to see what it's for, I just patched it instead:
 
 
  	  | Code: |  	  | 00403C03    FF15 BC104000   CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCo>; MSVBVM60.__vbaStrCopy 00403C09    0FBF43 34       MOVSX EAX,WORD PTR DS:[EBX+34]
 00403C0D    48              DEC EAX
 00403C0E    0F84 71170000   JE a.00405385
 00403C14    83E8 02         SUB EAX,2
 00403C17    0F84 1E170000   JE a.0040533B
 00403C1D    83E8 02         SUB EAX,2
 00403C20    0F85 23170000   JNZ a.00405349
 00403C26    8B13            MOV EDX,DWORD PTR DS:[EBX]
 | 
 
 NOP out the jumps in there or patch them to not work. Easier to nop. Once thats down scan for __vbStrcmp like any other VB crackme. Once found you will find it here:
 
 
  	  | Code: |  	  | 00405234    FF15 68104000   CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>; MSVBVM60.__vbaStrCmp | 
 
 Look at the buffers being compared. (EAX = your pass, ECX = real pass)
 
 Working set of username/pass:
 Name: aaaaaaaaa
 Pass: _Zhi 0Zo0g
 _________________
 
 - Retired. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| himpula How do I cheat?
 
 ![]() Reputation: 0 
 Joined: 26 Dec 2007
 Posts: 5
 
 
 | 
			
				|  Posted: Sun Jul 20, 2008 2:12 pm    Post subject: |   |  
				| 
 |  
				|  	  | Wiccaan wrote: |  	  |  	  | himpula wrote: |  	  | Use 123 as name and pass. | 
 All you did was patch the bad message to display the good one. That really isn't cracking it.
 
 | 
 
 I know, I wanted to see if anyone could notice that.
   |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| sumnewdude Expert Cheater
 
 ![]() Reputation: 0 
 Joined: 23 May 2007
 Posts: 181
 Location: Where you least expect me.
 
 | 
			
				|  Posted: Fri Jul 25, 2008 10:34 pm    Post subject: |   |  
				| 
 |  
				| Yay someone has finally tryed to crack it! himpula did not fully patch it therefore did not get the right message and Wiccaan . . . I can't get your info to work. . . I'll have to look at it more. _________________
 
   .erutangis ruoy ni siht esu neht ,sdrawkcab siht daer ot hguone trams erew uoy fI
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		|  |