- Prison Code Breaker Diary -

You need to install these tools and utilities to work with:

1. Sysinternals Suite: available from: http://sysinternals.com/
2. OllyDbg: available from: http://ollydbg.de/
3. IDA Pro (freeware): available from: http://www.hex-rays.com/idapro/
4. PEiD: available from: http://www.peid.info/
5. Several packer and unpacker around if require.

You will find more utilities around Internet that can be useful for your work. Just hang around with Google!
Get ready for the next step!

Have fun!

[ Crackme Info ]
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: Assembler
Refer: click here
Click to Download

Load into IDA, we have the main program

.text:08048085               mov     ebx, 1           ; fd
.text:0804808A               mov     ecx, offset aPassword ; "\nPassword : "
.text:0804808F               mov     edx, 0Dh           ; len
.text:08048094               int     80h           ; LINUX - sys_write
.text:08048096               mov     edx, 100h       ; len
.text:0804809B               mov     ecx, offset asc_804911B ; "        "
.text:080480A0               mov     ebx, 0           ; fd
.text:080480A5               mov     eax, 3
.text:080480AA               int     80h           ; LINUX - sys_read
.text:080480AC               mov     esi, offset aQtbxctu ; "QTBXCTU"
.text:080480B1               mov     edi, esi
.text:080480B3               xor     ebx, ebx
.text:080480B5               cld
.text:080480B6
.text:080480B6 loc_80480B6:                   ; CODE XREF: start+43j
.text:080480B6               lodsb
.text:080480B7               xor     al, 21h
.text:080480B9               stosb
.text:080480BA               inc     ebx
.text:080480BB               cmp     ebx, 7
.text:080480C1               jz      short loc_80480C5
.text:080480C3               loop    loc_80480B6
.text:080480C5
.text:080480C5 loc_80480C5:                   ; CODE XREF: start+41j
.text:080480C5               mov     esi, offset asc_804911B ; "        "
.text:080480CA               mov     edi, offset aQtbxctu ; "QTBXCTU"
.text:080480CF               mov     ecx, 7
.text:080480D4               cld
.text:080480D5               repe cmpsb
.text:080480D7               jnz     short loc_80480EF
.text:080480D9               mov     eax, 4
.text:080480DE               mov     ebx, 1           ; status
.text:080480E3               mov     ecx, offset unk_8049105 ; addr
.text:080480E8               mov     edx, 16h           ; len
.text:080480ED               int     80h           ; LINUX - sys_write
.text:080480EF
.text:080480EF loc_80480EF:                   ; CODE XREF: start+57j
.text:080480EF               mov     eax, 1
.text:080480F4               int     80h           ; LINUX - sys_exit
.text:080480F4 start           endp
.text:080480F4
.text:080480F4 _text           ends
.text:080480F4

Each bytes of our input password is encrypted:

.text:080480B6 loc_80480B6:                   ; CODE XREF: start+43j
.text:080480B6               lodsb
.text:080480B7               xor     al, 21h
.text:080480B9               stosb
.text:080480BA               inc     ebx
.text:080480BB               cmp     ebx, 7
.text:080480C1               jz      short loc_80480C5
.text:080480C3               loop    loc_80480B6

So, the real password can be found if we decrypt the string "QTBXCTU".
The encryption is simple, each byte is XORed w/ 0x21.
Then, we also use XORed w/ 0x21 to decrypt it.
Here a little perl script I wrote to decrypt.

#!/usr/bin/perl
my $cipher_txt = "QTBXCTU";
my $plain_txt;

my @arr = unpack("C*", $cipher_txt);
foreach my $c (@arr) {
   $plain_txt .= chr( $c ^ 0x21 );
}

print $plain_txt, "\n";

Have fun!@

I use these crackmes as a practice for reversing and debugging skills. However, any time I solve a crackme, I make a post as a guide for those who have the same interest as me and have troubles with them.
These crackmes are dedicated to run under Linux environment only, not Windows.
I collect these crackmes on crackmes.de site, so I can visit that site and check out for information.
Hope this would be helpful to someone.

[Level: EASIEST, FOR NEWBIES ONLY]

Guide to crack "Easy Linux Crackme" by lord
Solve cyrex's Linux CrackMe
Solve cyrex's Linux Crackme02
Solve dynsym's Crackme
Solve intsig's Easymath
Solve Qnix's qcrk5
Solve cli3nt's mycrk
Solve lord's Easy Crackme 2

[ to be updated...]

Have fun!@

==:: Crackme Info ::==
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: C/C++
Refer: click here
Click to Download

Use GDB to disassemble the main function

0x080483c4 <main+0>:    push   %ebp
0x080483c5 <main+1>:    mov    %esp,%ebp
0x080483c7 <main+3>:    sub    $0x18,%esp
0x080483ca <main+6>:    and    $0xfffffff0,%esp
0x080483cd <main+9>:    mov    $0x0,%eax
0x080483d2 <main+14>:    sub    %eax,%esp
0x080483d4 <main+16>:    movl   $0x11e67,-0x4(%ebp)
0x080483db <main+23>:    movl   $0x5b1270,-0x8(%ebp)
0x080483e2 <main+30>:    movl   $0x6,-0x10(%ebp)
0x080483e9 <main+37>:    sub    $0xc,%esp
0x080483ec <main+40>:    push   $0x8048514
0x080483f1 <main+45>:    call   0x80482e4 <printf@plt>
0x080483f6 <main+50>:    add    $0x10,%esp
0x080483f9 <main+53>:    sub    $0x8,%esp
0x080483fc <main+56>:    lea    -0xc(%ebp),%eax
0x080483ff <main+59>:    push   %eax
0x08048400 <main+60>:    push   $0x8048522
0x08048405 <main+65>:    call   0x80482c4 <scanf@plt>
0x0804840a <main+70>:    add    $0x10,%esp
0x0804840d <main+73>:    mov    -0x8(%ebp),%eax
0x08048410 <main+76>:    cmp    -0xc(%ebp),%eax
0x08048413 <main+79>:    jne    0x8048432 <main+110>
0x08048415 <main+81>:    mov    -0x10(%ebp),%edx
0x08048418 <main+84>:    lea    -0x4(%ebp),%eax
0x0804841b <main+87>:    xor    %edx,(%eax)
0x0804841d <main+89>:    sub    $0x8,%esp
0x08048420 <main+92>:    pushl  -0x4(%ebp)
0x08048423 <main+95>:    push   $0x8048525
0x08048428 <main+100>:    call   0x80482e4 <printf@plt>
0x0804842d <main+105>:    add    $0x10,%esp
0x08048430 <main+108>:    jmp    0x8048442 <main+126>
0x08048432 <main+110>:    sub    $0xc,%esp
0x08048435 <main+113>:    push   $0x8048529
0x0804843a <main+118>:    call   0x80482e4 <printf@plt>
0x0804843f <main+123>:    add    $0x10,%esp
0x08048442 <main+126>:    mov    $0x0,%eax
0x08048447 <main+131>:    leave
0x08048448 <main+132>:    ret 

So,
[ebp-4] = 0x11E67
[ebp-8] = 0x5b1270
[ebp-c] is our input key

the comparison check

0x0804840d <main+73>:    mov    -0x8(%ebp),%eax
0x08048410 <main+76>:    cmp    -0xc(%ebp),%eax
0x08048413 <main+79>:    jne    0x8048432 <main+110>

So easy, the real key is hardcoded, and it is at [ebp-8] = 0x5b1270, which is 5968496 in decimal.
If equal, the [ebp-4] is calculated

0x08048415 <main+81>:    mov    -0x10(%ebp),%edx
0x08048418 <main+84>:    lea    -0x4(%ebp),%eax
0x0804841b <main+87>:    xor    %edx,(%eax)

After XOR, the value of eax is 0x11E61, which is 73313 in decimal.
If wrong, the message "wrong" is output.
This is a good easy crackme for newbie.

Have fun!@

==:: Crackme Info ::==
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: C/C++
Refer: click me
Click to Download

This crackme is in fact pretty tough for beginner, like me . Since it's built in static mode, everything's just look very confusing.
I will use IDA, then go to the Entry Point of main function.
Here it is

.text:08048208
.text:08048208 ; Attributes: bp-based frame
.text:08048208
.text:08048208 sub_8048208     proc near           ; DATA XREF: start+17o
.text:08048208
.text:08048208 var_28           = dword ptr -28h
.text:08048208 var_24           = dword ptr -24h
.text:08048208 var_20           = dword ptr -20h
.text:08048208 var_1C           = dword ptr -1Ch
.text:08048208 var_14           = dword ptr -14h
.text:08048208 var_8           = dword ptr -8
.text:08048208 var_4           = dword ptr -4
.text:08048208 arg_0           = dword ptr  8
.text:08048208 arg_4           = dword ptr  0Ch
.text:08048208
.text:08048208               push    ebp
.text:08048209               mov     ebp, esp
.text:0804820B               sub     esp, 28h
.text:0804820E               and     esp, 0FFFFFFF0h
.text:08048211               mov     eax, 0
.text:08048216               add     eax, 0Fh
.text:08048219               add     eax, 0Fh
.text:0804821C               shr     eax, 4
.text:0804821F               shl     eax, 4
.text:08048222               sub     esp, eax
.text:08048224               mov     [ebp+var_4], 4B7F3DA0h
.text:0804822B               mov     [esp+28h+var_1C], 0
.text:08048233               mov     [esp+28h+var_20], 1
.text:0804823B               mov     [esp+28h+var_24], 0
.text:08048243               mov     [esp+28h+var_28], 0
.text:0804824A               call    sub_804EA50
.text:0804824F               test    eax, eax
.text:08048251               jns     short loc_8048260
.text:08048253               mov     eax, 1
.text:08048258               mov     [ebp+var_14], eax
.text:0804825B               jmp     loc_8048335
.text:08048260 ; ---------------------------------------------------------------------------
.text:08048260
.text:08048260 loc_8048260:                   ; CODE XREF: sub_8048208+49j
.text:08048260               cmp     [ebp+arg_0], 2
.text:08048264               jz      short loc_8048291
.text:08048266               mov     eax, [ebp+arg_4]
.text:08048269               mov     eax, [eax]
.text:0804826B               mov     edx, off_80AF3B4
.text:08048271               mov     [esp+28h+var_20], eax
.text:08048275               mov     [esp+28h+var_24], offset    aUsageSPassword    ; "Usage : %s \n"
.text:0804827D               mov     [esp+28h+var_28], edx
.text:08048280               call    sub_8049530
.text:08048285               mov     [esp+28h+var_28], 0
.text:0804828C               call    sub_8048C10
.text:08048291 ; ---------------------------------------------------------------------------
.text:08048291
.text:08048291 loc_8048291:                   ; CODE XREF: sub_8048208+5Cj
.text:08048291               mov     eax, [ebp+arg_4]
.text:08048294               add     eax, 4
.text:08048297               mov     eax, [eax]
.text:08048299               mov     [esp+28h+var_28], eax
.text:0804829C               call    sub_8048BE0
.text:080482A1               mov     [ebp+var_8], eax
.text:080482A4               lea     eax, [ebp+var_8]
.text:080482A7               add     dword ptr [eax],    5
.text:080482AA               lea     eax, [ebp+var_8]
.text:080482AD               add     dword ptr [eax],    60h
.text:080482B0               mov     edx, [ebp+var_8]
.text:080482B3               mov     eax, edx
.text:080482B5               shl     eax, 8
.text:080482B8               sub     eax, edx
.text:080482BA               mov     [ebp+var_8], eax
.text:080482BD               mov     eax, [ebp+var_8]
.text:080482C0               imul    eax, 909090h
.text:080482C6               mov     [ebp+var_8], eax
.text:080482C9               mov     eax, [ebp+arg_4]
.text:080482CC               add     eax, 4
.text:080482CF               mov     eax, [eax]
.text:080482D1               mov     edx, off_80AF3B4
.text:080482D7               mov     [esp+28h+var_20], eax
.text:080482DB               mov     [esp+28h+var_24], offset    aUsingS    ; "Using %s\n"
.text:080482E3               mov     [esp+28h+var_28], edx
.text:080482E6               call    sub_8049530
.text:080482EB               mov     eax, [ebp+var_4]
.text:080482EE               cmp     eax, [ebp+var_8]
.text:080482F1               jnz     short loc_8048314
.text:080482F3               mov     eax, off_80AF3B4
.text:080482F8               mov     [esp+28h+var_24], offset    aCorrectCracked    ; "Correct, Cracked !!\n"
.text:08048300               mov     [esp+28h+var_28], eax
.text:08048303               call    sub_8049530
.text:08048308               mov     [esp+28h+var_28], 0
.text:0804830F               call    sub_8048C10
.text:08048314 ; ---------------------------------------------------------------------------
.text:08048314
.text:08048314 loc_8048314:                   ; CODE XREF: sub_8048208+E9j
.text:08048314               mov     eax, off_80AF3B4
.text:08048319               mov     [esp+28h+var_24], offset    aWrong ; "Wrong!\n"
.text:08048321               mov     [esp+28h+var_28], eax
.text:08048324               call    sub_8049530
.text:08048329               mov     [esp+28h+var_28], 0
.text:08048330               call    sub_8048C10
.text:08048335 ; ---------------------------------------------------------------------------
.text:08048335
.text:08048335 loc_8048335:                   ; CODE XREF: sub_8048208+53j
.text:08048335               mov     eax, [ebp+var_14]
.text:08048338               leave
.text:08048339               retn
.text:08048339 sub_8048208     endp
.text:08048339
.text:08048339 ;

This is where the input is compared

.text:080482EB               mov     eax, [ebp+var_4]
.text:080482EE               cmp     eax, [ebp+var_8]
.text:080482F1               jnz     short loc_8048314

There have 2 solutions here as usual: Patch & Keygen

1. Patch:
- Just do this as a practice since author doesn't allow patching. For beginners, it's good to know how to patch as well.
- We patch the Jump at 0x080482F1 from: 75 21 to: 90 90

2. Keygen:
- Look at the code flow, you can see [ebp+var_4] doesn't change in main. Its value is assigned at beginning:

.text:08048224               mov     [ebp+var_4], 4B7F3DA0h

- The translation of disassembly part

.text:08048291               mov     eax, [ebp+arg_4]
.text:08048294               add     eax, 4
.text:08048297               mov     eax, [eax]
.text:08048299               mov     [esp+28h+var_28], eax
.text:0804829C               call    sub_8048BE0                ; atoi( argv[1] )
.text:080482A1               mov     [ebp+var_8], eax            ; var_8 = atoi( arv[1] )
.text:080482A4               lea     eax, [ebp+var_8]            ; eax = var_8
.text:080482A7               add     dword ptr [eax],    5        ; eax += 5
.text:080482AA               lea     eax, [ebp+var_8]
.text:080482AD               add     dword ptr [eax],    60h        ; eax += 60
.text:080482B0               mov     edx, [ebp+var_8]            ; edx = var_8
.text:080482B3               mov     eax, edx                    ; eax = edx
.text:080482B5               shl     eax, 8                    ; eax <<= 8
.text:080482B8               sub     eax, edx                    ; eax = eax - edx
.text:080482BA               mov     [ebp+var_8], eax
.text:080482BD               mov     eax, [ebp+var_8]            ; eax = var_8
.text:080482C0               imul    eax, 909090h                ; eax = eax * 909090
.text:080482C6               mov     [ebp+var_8], eax            ; var_8 = eax
.text:080482C9               mov     eax, [ebp+arg_4]
.text:080482CC               add     eax, 4
.text:080482CF               mov     eax, [eax]
.text:080482D1               mov     edx, off_80AF3B4
.text:080482D7               mov     [esp+28h+var_20], eax
.text:080482DB               mov     [esp+28h+var_24], offset    aUsingS    ; "Using %s\n"
.text:080482E3               mov     [esp+28h+var_28], edx
.text:080482E6               call    sub_8049530
.text:080482EB               mov     eax, [ebp+var_4]            ; var_4 = 4B7F3DA0
.text:080482EE               cmp     eax, [ebp+var_8]            ; var_8
.text:080482F1               jnz     short loc_8048314 

Here is the simple keygen written in C

#include <stdio.h>

unsigned int
compute( unsigned int i )
{
register unsigned int x, y;
x = y = (i + 0x65);
x <<= 8;
x -= y;
x *= 0x909090;
return x;
}

int
main( int argc, char *argv[] )
{
unsigned int i = 0;
const int TARGET = 0x4B7F3DA0;
while( i < 0xFFFFFFFF ) {
 if( compute(i) == TARGET ) {
  printf("[+] Found: %u \n", i);
 }
 ++i;
}
return 0;
}

Have fun!@

==:: Crackme Info ::==
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: C/C++
Refer: click here
Click to Download

The crackme will only print 'done' message if we get the correct password only.
This crackme seems to be very complicated. If you try to dump it with Dasm2 or load through GDB, it certainly doesn't work at all.
We use readelf to look at its header information

$ readelf -e easymath
ELF Header:
Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class:                             ELF32
Data:                              2's complement, little endian
Version:                           1 (current)
OS/ABI:                            UNIX - System V
ABI Version:                       0
Type:                              EXEC (Executable file)
Machine:                           Intel 80386
Version:                           0x1
Entry point address:               0x8048380
Start of program headers:          52 (bytes into file)
Start of section headers:          0 (bytes into file)
Flags:                             0x0
Size of this header:               52 (bytes)
Size of program headers:           32 (bytes)
Number of program headers:         7
Size of section headers:           0 (bytes)
Number of section headers:         0
Section header string table index: 0 <corrupt: out of range>

There are no sections in this file.

Program Headers:
Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
PHDR           0x000034 0x08048034 0x08048034 0x000e0 0x000e0 R E 0x4
INTERP         0x000114 0x08048114 0x08048114 0x00013 0x00013 R   0x1
   [Requesting program interpreter: /lib/ld-linux.so.2]
LOAD           0x000000 0x08048000 0x08048000 0x00644 0x00644 R E 0x1000
LOAD           0x000644 0x08049644 0x08049644 0x00110 0x00114 RW  0x1000
DYNAMIC        0x000658 0x08049658 0x08049658 0x000c8 0x000c8 RW  0x4
NOTE           0x000128 0x08048128 0x08048128 0x00020 0x00020 R   0x4
GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4

It's not looking good at all.
Let's load it with IDA. Here a little view:


Jump to entry point of program: Ctrl+E -> start

LOAD:08048380 ;    Attributes: noreturn
LOAD:08048380
LOAD:08048380              public start
LOAD:08048380 start          proc near
LOAD:08048380              xor     ebp, ebp
LOAD:08048382              pop     esi
LOAD:08048383              mov     ecx, esp
LOAD:08048385              and     esp, 0FFFFFFF0h
LOAD:08048388              push    eax
LOAD:08048389              push    esp
LOAD:0804838A              push    edx
LOAD:0804838B              push    offset sub_8048580
LOAD:08048390              push    offset sub_8048510
LOAD:08048395              push    ecx
LOAD:08048396              push    esi
LOAD:08048397              push    offset sub_8048438
LOAD:0804839C              call    sub_8048344
LOAD:080483A1              hlt
LOAD:080483A1 start          endp

So, the OEP of main() is call

LOAD:08048397              push    offset sub_8048438

Jump to main() [G: 8048438]

Scroll down a bit:

LOAD:0804849E loc_804849E:                  ;    CODE XREF: sub_8048438+47j
LOAD:0804849E              mov     [ebp+var_10], 6
LOAD:080484A5              mov     [ebp+var_C], 2
LOAD:080484AC              mov     [ebp+var_8], 0
LOAD:080484B3              mov     [ebp+var_4], 4530h
LOAD:080484BA              mov     eax, [ebp+arg_4]
LOAD:080484BD              add     eax, 4
LOAD:080484C0              mov     eax, [eax]
LOAD:080484C2              sub     esp, 0Ch
LOAD:080484C5              push    eax
LOAD:080484C6              call    sub_8048354
LOAD:080484CB              add     esp, 10h
LOAD:080484CE              mov     [ebp+var_14], eax
LOAD:080484D1              nop
LOAD:080484D2              mov     eax, [ebp+var_10]
LOAD:080484D5              mov     edx, eax
LOAD:080484D7              imul    edx, [ebp+var_C]
LOAD:080484DB              mov     eax, [ebp+var_14]
LOAD:080484DE              imul    eax, edx
LOAD:080484E1              mov     [ebp+var_8], eax
LOAD:080484E4              xor     eax, eax
LOAD:080484E6              mov     eax, [ebp+var_4]
LOAD:080484E9              cmp     eax, [ebp+var_8]
LOAD:080484EC              jnz     short loc_80484FE
LOAD:080484EE              sub     esp, 0Ch
LOAD:080484F1              push    offset aDone    ;    "done"
LOAD:080484F6              call    sub_8048324
LOAD:080484FB              add     esp, 10h

So, the comparison is at: 0x080484E9 and the jump is below.
There're two ways to solve this problem: Patch & KeyGen

1. Patch:
- We will NOP at the jump. The offset of the jump is at 0x4EC
- Load hexedit

$ hexedit easymath

Press {Enter} then type the offset: 0x4EC
- We patch 2 bytes: 75 10 into 90 90
F2 to save then F10 (or Ctrl+X) to quit.
- Run crackme with any-value argument

2. Keygen:
- Take a closer look at disassembly code above, I explain them like this:

LOAD:0804849E              mov     [ebp+var_10], 6            ; var_10 = 6
LOAD:080484A5              mov     [ebp+var_C], 2            ; var_C  = 2
LOAD:080484AC              mov     [ebp+var_8], 0            ; var_8  = 0
LOAD:080484B3              mov     [ebp+var_4], 4530h        ; var_4  = 4530
LOAD:080484BA              mov     eax, [ebp+arg_4]
LOAD:080484BD              add     eax, 4
LOAD:080484C0              mov     eax, [eax]
LOAD:080484C2              sub     esp, 0Ch
LOAD:080484C5              push    eax
LOAD:080484C6              call    sub_8048354                ; atoi( argv[1] )
LOAD:080484CB              add     esp, 10h
LOAD:080484CE              mov     [ebp+var_14], eax            ; var_14 = atoi( argv[1] )
LOAD:080484D1              nop
LOAD:080484D2              mov     eax, [ebp+var_10]            ; eax = var_10 = 6
LOAD:080484D5              mov     edx, eax                    ; edx = eax = 6
LOAD:080484D7              imul    edx, [ebp+var_C]            ; edx = edx * var_C = 6 * 2 = C
LOAD:080484DB              mov     eax, [ebp+var_14]            ; eax = var_14
LOAD:080484DE              imul    eax, edx                    ; eax = eax * edx = var_14 * C
LOAD:080484E1              mov     [ebp+var_8], eax            ; var_8 = eax = var_14 * C
LOAD:080484E4              xor     eax, eax                    ; eax = 0
LOAD:080484E6              mov     eax, [ebp+var_4]            ; eax = var_4
LOAD:080484E9              cmp     eax, [ebp+var_8]            ; eax == var_8 ?
LOAD:080484EC              jnz     short loc_80484FE            ; 0x080484EC if true : 0x80484FE else
LOAD:080484EE              sub     esp, 0Ch
LOAD:080484F1              push    offset aDone    ;    "done"
LOAD:080484F6              call    sub_8048324
LOAD:080484FB              add     esp, 10h

As you can see, var_14 is our input as argv[1]. So it must be the number N that satisfies the equation: N * C = 4530 (in hex).
So, N = 5C4 or 1476 in decimal.
Try it

$ ./easymath 1476
done

That's all for this crackme.

Have fun!@

==:: Crackme Info ::==
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: C/C++
Refer: click me
Click to Download

Disassembly main() function to see what's going on.

(gdb) disas main

Look at this

0x080484b0 :    movl   $0x80485e3,(%esp)
0x080484b7 :    call   0x804831c 

This is the string: [!] Solved!
Look up a little bit, we can see

0x0804846c :    mov    $0xa,%ecx
0x08048471 :    mov    0x4(%edx),%esi
0x08048474 :    repz cmpsb %es:(%edi),%ds:(%esi)
0x08048476 :    je     0x80484b0 

It's how it goes.
There's a byte-to-byte comparison at EDI and ESI, up to 0x0A bytes then jump if they're still equal to each other; then, it certainly prints the good message. Otherwise, it will fail.

There're solution you can do at this point.
1. Patch the Jump
2. Check for string in EDI

Let's do both of these as a practice.

1. Patching:

$ gdb --write -nx -q crackme1
(gdb) x/x 0x8048474
0x8048474 :    0x3874a6f3
(gdb) set {int} 0x8048474 = 0x38749090
(gdb) q
$ ./crackme1
[!] Solved!

2. Trace through EDI
- Set breakpoint at main+65 then run

(gdb) x/s $edi
0x80485d4:     "__gmon_start__"

ok..since it compares only 10 bytes, then we just need to pass our arguments as: __gmon_sta is enough or whatever is next the string.

Have fun!@

Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: C/C++
Link: Click to refer
Click to Download

Try to run it first to see how it works.
Then launch gdb. Check out for function symbols

(gdb) info func
0x080483b0  __register_frame_info
0x080483b0  __register_frame_info@plt
0x080483c0  strcmp@plt
0x080483d0  scanf@plt
0x080483e0  __deregister_frame_info
0x080483e0  __deregister_frame_info@plt
0x080483f0  ptrace@plt
0x08048400  __libc_start_main@plt
0x08048410  printf@plt
0x08048420  exit@plt
0x08048430  fopen@plt

Hum....strcmp() and fopen() are called, then must be something about the real password comparison and file operation.
Boom...this crackme calls ptrace(), why?
Let's try to set breakpoint at strcmp() and fopen()

(gdb) b 0x080483c0
(gdb) b 0x08048430
(gdb) run
Are you trying to Debug me?

Bang ! So this crackme calls ptrace() for anti-debugging.

Quit gdb. We switch into dasm2.
Disassembly it:

$ dasm2 crackme -output=dump

push    $8048800                        ;  reference to data : "-[ Linux CrackMe (Level:3) by cyrex ]-"

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff4,%esp                  ;
 push    $8048840                        ;  reference to data : "-[ TODO: Get the valid password     ]-"

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff4,%esp                  ;
 push    $8048868                        ;  reference to data : "-[ Enter Password: "

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff8,%esp                  ;
 lea     -400(%ebp),%eax                 ;
 push    %eax                            ;
 push    $804887c                        ;  reference to data : "%s"

 call    080483d0                        ;
 add     $10,%esp                        ;
 add     $fffffff8,%esp                  ;
 lea     -400(%ebp),%eax                 ;
 push    %eax                            ;
 push    $804887f                        ;  reference to data : "-[ Entered Password: %s"

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff4,%esp                  ;
 push    $8048898                        ;  reference to data : "-[ Checking Stage 1 Now....."

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff8,%esp                  ;
 push    $80488b6                        ;  reference to data : "7gb5fjf8v4bg8fb34f"

 lea     -400(%ebp),%eax                 ;
 push    %eax                            ;
 call    080483c0                        ;
 add     $10,%esp                        ;
 mov     %eax,%eax                       ;
 test    %eax,%eax                       ;
 jne     08048600                        ;
 add     $fffffff4,%esp                  ;
 push    $80488c9                        ;  reference to data : "-[ Stage 1 Cleared"

 call    08048410                        ;
 add     $10,%esp                        ;
 jmp     08048614                        ;
 lea     0(%esi),%esi                    ;
 add     $fffffff4,%esp                  ;  referenced from jump(s) at 080485e9;

 push    $80488dd                        ;  reference to data : "-[ Game Over"

 call    08048410                        ;
 add     $10,%esp                        ;
 xor     %eax,%eax                       ;
 jmp     08048690                        ;
 add     $fffffff4,%esp                  ;  referenced from jump(s) at 080485fb;

 push    $80488eb                        ;  reference to data : "-[ Checking Stage 2 Now...."

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff8,%esp                  ;
 push    $8048908                        ;  reference to data : "r"

 push    $8048920                        ;  reference to data : "/tmp/crackme_89nfnjfiefheufeue"

 call    08048430                        ;
 add     $10,%esp                        ;
 mov     %eax,%eax                       ;
 mov     %eax,-404(%ebp)                 ;
 cmpl    $0,-404(%ebp)                   ;  reference to data : "__gmon_start__"

 jne     08048667                        ;
 add     $fffffff4,%esp                  ;
 push    $8048940                        ;  reference to data : "-[ Bad did you forgot something?"

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff4,%esp                  ;
 push    $0                              ;  reference to data : "__gmon_start__"

 call    08048420                        ;
 add     $10,%esp                        ;
 add     $fffffff4,%esp                  ;  referenced from jump(s) at 08048648;

 push    $8048980                        ;  reference to data : "-[ You have successfully reversed/cracked/sniffed This Crackme"

 call    08048410                        ;
 add     $10,%esp                        ;
 add     $fffffff4,%esp                  ;
 push    $80489c0                        ;  reference to data : "-[ Email me your solution to eth0@list.ru"

So the first password is: "7gb5fjf8v4bg8fb34f"
And then because it reads a file "/tmp/crackme_89nfnjfiefheufeue" (not writing), if the file exists, then good message shows; otherwise, fail.

Have fun!@

[ Crackme Info ]
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: C/C++
Links: Click to refer
Click to Download

First, run the crackme, it requires to input the right password.
Launch gdb

$ gdb crackme

Check function symbols

(gdb) info func
0x0804831c  strcmp
0x08048450  main

Look over main function

(gdb) disas main

We see this part:

0x0804849d :    push   $0x80486a4
0x080484a2 :    lea    -0x20(%ebp),%eax
0x080484a5 :    push   %eax
0x080484a6 :    call   0x804831c 

So, the address 0x80486a4 may contain the real password
Let's check it.

(gdb) b *main+86
(gdb) run

After input, it stops at our breakpoint.
First, have a look at EAX

(gdb) x/s $eax
0xbfc5a498:     "japhcracker"

This is our input, let see the value at 0x80486a4

(gdb) x/s 0x80486a4
0x80486a4:     "47ghf6fh37fbgbgj"

Exit gdb, run the program and input the above string. It must be the password.

Have fun!@

-:== Crackme Info ==:-
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: Assembler
Link: Click to refer

Solution:

This is a pretty simple crackme under Linux. The tools you need is GNU Debugger (GDB) and OBJDUMP, supported w/ every Linux distribution.

Download then extract file.

If you run the executables blah, it shows nothing.
Let's have a quick view of this binary in assembly

$ objdump -D blah

This is result

blah:     file format elf32-i386


Disassembly of section .text:

08048094 <.text>:
8048094:    31 c0                    xor    %eax,%eax
8048096:    b8 2f 00 00 00           mov    $0x2f,%eax
804809b:    cd 80                    int    $0x80
804809d:    3d ad de 00 00           cmp    $0xdead,%eax
80480a2:    75 16                    jne    0x80480ba
80480a4:    b8 04 00 00 00           mov    $0x4,%eax
80480a9:    bb 01 00 00 00           mov    $0x1,%ebx
80480ae:    b9 c4 90 04 08           mov    $0x80490c4,%ecx
80480b3:    ba 06 00 00 00           mov    $0x6,%edx
80480b8:    cd 80                    int    $0x80
80480ba:    31 c0                    xor    %eax,%eax
80480bc:    40                       inc    %eax
80480bd:    31 db                    xor    %ebx,%ebx
80480bf:    cd 80                    int    $0x80

Disassembly of section .data:

080490c4 <.data>:
80490c4:    4f                       dec    %edi
80490c5:    6b 65 6a 21              imul   $0x21,0x6a(%ebp),%esp
80490c9:    0a                       .byte 0xa

Quick view, as you know about Linux programming, you surely know the the system call (interrupt) 80h.

The first syscall:

8048094:    31 c0                    xor    %eax,%eax
8048096:    b8 2f 00 00 00           mov    $0x2f,%eax
804809b:    cd 80                    int    $0x80

This syscall is to retrieve the group id (0x2f), getgid().
Reference Linux system call table

And then, program will try to compare the result from getgid() and 0xDEAD.
If not equal, it will jump below

80480ba:    31 c0                    xor    %eax,%eax
80480bc:    40                       inc    %eax
80480bd:    31 db                    xor    %ebx,%ebx
80480bf:    cd 80                    int    $0x80

This is the exit() syscall (0x01).

If it equals, then the program will try to print the message by syscall write().
The message is stored in data section (0x080490C4).

OK!
So, here we can find our solutions.
+ Either, create a new group and set id is 0xDEAD (57005)
+ Or, patch the conditional jump.

The first solution is to set group id to 57005 ( using setgid() ), then add user to the group by groupadd().

I'm going to talk about patching the jump next.

Load gdb

$ gdb blah

We set breakpoint at 0x804809d

(gdb) break *0x804809d

(gdb) run
Breakpoint 1, 0x0804809d in ?? ()

(gdb) info registers
eax            0x1f4    500
ecx            0x0    0
edx            0x0    0
ebx            0x0    0
esp            0xbf9c04d0    0xbf9c04d0
ebp            0x0    0x0
esi            0x0    0
edi            0x0    0
eip            0x804809d    0x804809d
eflags         0x200246    [ PF ZF IF ID ]
cs             0x73    115
ss             0x7b    123
ds             0x7b    123
es             0x7b    123
fs             0x0    0
gs             0x0    0

As you see, my group id is 500 (stored in EAX); hence, program will exit immediately.
Let's do the patch 2-NOP bytes at 0x80480a2

(gdb) x/x 0x80480a2
0x80480a2:    0x04b81675

We need to patch 2 bytes: 75 16
therefore,

(gdb) set {int} 0x80480a2 = 0x04b89090
(gdb) quit

Now re-run the patched crackme.

$ ./blah
Okej!

well done! you patched the crackme.
Hope this tutorial be a little guide for whom to start cracking in Linux like me.

Have fun!@

Let's do this crackme together.

Serial
Difficulty: 1 - Very easy, for newbies
Platform: Windows
Language: C/C++

Published: 19. Sep, 2002

Download

What we need to do w/ this one is to find the correct serial.

Let's begin!

1. First, just run crackme to check its behavior.
- type anything into the text box then click ok

- boom, a message box
2. OK! Let's load it into OllyDbg

- Right click -> Search for -> All referenced text strings
- You will see this section


- Double-click on "Wrong Code! Try again!" to access its memory region on main window.
- Scroll up, there's a jump above

004016D7  |. 74 1D          JE SHORT CrackMe1.004016F6
004016D9  |. 6A 00          PUSH 0
004016DB  |. B9 A0D34600    MOV ECX,CrackMe1.0046D3A0                ;  ASCII "CrackMe #1 By DiABLO"
004016E0  |. BA 89D34600    MOV EDX,CrackMe1.0046D389                ;  ASCII "Wrong Code! Try Again!"

- Then it must be compared the serial somewhere above.
[*] Well, the string "***vErYeAsY***" is really suspicious. It just appears out of nowhere.
- You might Step over that memory space around to check the process ^^!

The rest is up all to you, then!

Have fun!@