Challenge of Reverse Engineering

[ Solutions so far: JohnWho, What ] (read whole thread) Hello folks. Decided I would post this here as well, as we're lacking some exercise on these kinds of targets. Purpose: open up the test target, click OK on the message box. Use any tool you want to alter a byte in application's active memory (e.g.: "MZ" string at ImageBase) and another message will appear. Goal: make the 'bad' message never pop-up, but not through patching the all-too-clear JUMP. Inline VMProtect's CRC check method so the CALL always returns 1. Again, not through MOV EAX,1|RETN (P.S.: imagine you don't know where this function is in a well-obfuscated target). …

View File VMProtectDDK v3.84 x64 No.2 2024 If you want to try this challenge, please read the following text descriptions: 1. Please try to debug the kernel driver in the virtual machine instead of your real machine to avoid causing a blue screen on the physical machine a. Why blue screen? For things like Ring0.sys, as I mentioned earlier b. Copy the Tuts4you.ini file to the C:\Windows\ directory of the virtual machine 2. I have added a test signature to the driver, so to load this driver, you need to enable Windows test mode a. Press and hold the "WIN+R" key to launch the CMD console as an administrator, enter b…

View File VMProtect x86 v3.81 (Default Protection Options) Please debug/unpack in the virtual machine This target is protected by a specially modified version of VMP, with some simple protection measures added It only supports running on x64 operating systems, such as Win7 x64 or Win10 x64, which may also support most Win11 x64 If you unpack it, please make tutorial(s)... I will mark the answers with tutorial(s) as solution. Submitter boot Submitted 07/27/2023 Category UnPac…

Protections: Winlicense Demo 2.2.7.0 (x64) Compiler: .NET If you succed to unpack please make a tutorial. WinlicenseUnpackMe.NET.rar

View File Fatmike's Crackme #4 ..::[FaTmiKE 2o23]::.. After a little break i decided to program another little crackme (This is my 4th crackme). Here are the rules: 1. The main goal is to unpack this crackme or write a loader. 2. If you like, find a valid serial or write a keygen. The crackme was tested on windows 10. Have fun! Submitter Fatmike Submitted 06/08/2023 Category UnPackMe  

View File CrackMe with Anti Patch The program uses VMP protection, and calls the relevant checksum SDK, even if the violent crack may also be slightly more complex, here provides a baymax patch tool to achieve the crack program, interested friends can read the pdf tutorial. The function of the program to determine whether the input is correct or not does not use the SDK for protection, and verify the error dialog box strings are searchable, but these do not mean that it is easy to crack, because the code also calls the memory checksum, determine whether the debugging and other SDK interfaces. So how to realize the cracking of this crac…

View File EAZFuscator .NET 2022.2 Max Preset (BlackHat) - Updated 04/06/22 Update 04-June 2022 Version 2022.2 Unpack Password - BH2022.2 Old 2022.1 Info - This unpackme is protected with latest version of EAZfuscator = https://www.gapotchenko.com/eazfuscator.net/features Password to unpack = EAZ2022 (I made a RAR file with password protection because I was unable to upload the unpackme directly. I was getting error due to false virus alarm) Your job is to unpack the file fully. Partial unpacking won't be accepted. Submitter BlackHat …

This target is protected by license Private Exe Protector 4.2.2 with License ID Who will unpack this file please write tutorial Valid data: License ID: NP10-AC091DD4-1AB5FFFD-B78DDCD79F6B3217 User name: tuts4you Activation key: 061ABBE2-CDB2B006-9ED78E20-609AA20E Good luck! UnPackMe Private Exe Protector 4.4.2.rar

View File CrackMe [.NET + Native] A little "CrackMe" challenge (.NET + Native). Need to crack the application so that it does not require a license for its operation. P. S. Application requires .NET 6 to run Submitter InvizCustos Submitted 01/28/2024 Category CrackMe  

View File WinLicense v3.1.3.0 x64 (Bypass Without Unpacking) License User Details User Name=2days Tuts4you Company=The Terminator Hardware ID=6FF7-E7EF-5988-20FE-144E-865D-2D30-A73B Custom Data=<custom_start>Skynet, a global network of artificial intelligence machines.<custom_end> License Restrictions Days Expiration=365 Date Expiration=2029/12/12 Executions=999 Runtime execution=999 Global Time=999 Install Before Date=2029/01/01 Miscellaneous Unicode License=yes Generated License (FILE KEY) License Format=Binary License Data= <license_start> ghO1ud4wf14YNU87wUptZ1J…

WinLicense x64 2.2.9.0 enjoy UnpackMex64.rar

View File AgileNET v6.6.0.4.2 AgileNET (code virtualization on 1 method only, no other protector features used) Submitter whoknows Submitted 11/12/2023 Category UnPackMe (.NET)  

View File NanoButton A follow up of TinyCrackMe Challenge: - Press the button "Hi" - If correctly bypass, a MessageBox with `:3` show up. Rules: 1. Patch? Here's a deal: - No patching if you're unpacked UPX, as final result! - Allowed patching if you're not unpacked UPX, as final result! - only patch-fix the flaw like missing stdc dll, or temporary byte patch to making loader or hook 2. Spoiling? Yes! (originally in crackmes.one is "no") 3. Keygen? useless. Because the goal is bypass it! 4. Hooking? Allowed! It's not a patch! 5. Loader? Allowed! It's just a mem patch, not file patch... 6. Any these above, do …

Find correct serial/s ch01.zip

patch HWID and unpackme The Enigma Protector 4.3(build 20150225) License type:Single tep4.3pacth+unpackme.rar

Language : Python Platform : Windows OS Version : All Packer / Protector : Pyarmor + My Protector Description : Want to see if someone can unpack it, want to use this obfuscator for my future aplications in python Screenshot : Spoiler Download : Virustotal: https://www.virustotal.com/gui/file/fec987a11c8bdd47355529389d75f1f2cb0f980a763efa21e796dd1a21619989/detection Download: https://anonfile.com/3fn5o8gdo5/UnpackME_by_0x72_rar UnpackME by 0x72.rar

This is UnpackMe, protected with .NET Reactor 4.9 All Protection Option. Unpack and Remove Nag MessageBox, please. UnpackMe.rar

Language : C# Platforms : Windows Packer/obfuscator : 198 Protector V2 ( ConfuserEx Modded ) Description : Hi everyone, hope one of you friends can unpack the target and teach us how to unpack it. Virustotal : https://www.virustotal.com/gui/file/07638f4335a23fbb62e7c8e471398a8d556ca8ecbdea8395f4d55f76aebe3bce/detection Download : Unpackme.exe

View File PELock DialogBox It's a PELock'ed file. Try to unpack it if you have time, if you are a skilled code reverser or the author, you maybe can do it. Thank you for your effort in advance. Submitter The Binary Expert Submitted 01/12/2022 Category UnPackMe  

Language : .NET Platform : Windows x32/x64 OS Version : All Packer / Protector : Anti Dump + IL Protection + Enigma Protector 3.50 Description : You need to unpack and change the Text. "Tuts4you Special Unpack Edition" Screenshot : UnpackMe by Lucifer.exe

View File NETBuilderInjection + VMP I took my NETBuilderInjection and turned it into a Protector, but I don't know how secure it is. (For me, it's safe enough.) So I made this little program, The objectives are: [Unpackme] You should unpack it and get the cleanest code possible. [Crackme] In the textbox where the HWID is displayed you must modify the text and write something else in it. [Bypass] You will need to disable "Falcon Anticheat" from the executable. ---------------------------------------------------------------------------- Difficulty : Unknown Language Base : .NET Platform : Windows - .NET Framework 4…

Difficulty : medium Language : c# Platform : Windows x32/x64 OS Version : All Packer / Protector : BEDS 4,5 Description : unpack and tell how fast did you unack it and the way if possible Screenshot : ConsoleApp1.rar

View File Safengine Licensor v2.3.4 过程式编程语言，所以IAT和资源很少 Safengine License 2.3.4 with medium protection options enabled. Program is written in assembly language so there are very few IAT and resources. Submitter kuazi GA Submitted 11/12/2023 Category UnPackMe  

View File Themida v2.4.6.30 This is a .NET executable with a Goland DLL packed with Themida. Try to unpack the executable, dump the bundled DLL then fix the DLL to make it work. Once completed detail the methods used and how you fixed the DLL. Submitter despy3 Submitted 12/17/2020 Category UnPackMe (.NET)  

View File Bypass MessageBox Without Unpacking Bypass MessageBox without unpacking, task complete. Submitter 2days Submitted 07/15/2023 Category CrackMe