T2 08 Challenge (Solved!)

[D1N]

T2 08 Challenge (Solved!)

Solved! Please check. Says look for clues in application... Every 5 minutes phrase "catch me if you can" comes up. When dump in memory I see "easterbunny" rabbits are hard to catch XD got it! If I'm wrong oh well! However I think I'm right!

email -> easterbunny@t2.fi located in challenge.mem

download

http://rapidshare.com/files/144605375/t2.f...ack.cn.zip.html

mem dump hex -> http://pastebin.ca/1200860

host.dll -> Themida/WinLicense V1.8.X-V1.9.X Other -> Oreans Technologies * Sign.By.fly * 20080131 *

challenge.exe -> PECompact 2.x -> Jeremy Collake

Shouts, ap0x, fly shooo, Ziggy, TeddyRogers, unpack.cn, ARTeam, RLPack, tuts4you.

http://www.t2.fi/

Update.... Waiting on response from T2 Team.

[mudlord]

Uh.....

Rules of the Challenge

1. Anybody (except organizers and employees of the company that made the challenge) can attend.

2. The answer must have a detailed description of methods and tools used.

3. It is not allowed to publish the solution on public forums.

4. It is not allowed to modify or distribute the binary.

5. All rights are reserved.

Isnt it against the rules what you are doing?

[D1N]

Wasnt aware of any "rules" in reverse engineering. I thought the point was to go beyond rules. :-) Hopefully the people at T2 (provided my solution is correct) will look past sharing information with the community. This is supposed to be for FUN!

Besides what better place to share your findings with my friends here at tuts4you and unpack.cn!

Edited September 12, 2008 by D1N