[crackme] Find the flag by extremecoders

[Extreme Coders]

This is a CTF style challenge. 

 

Objective  : You need to find the flag which will print the good boy message

Rules      : Everything is allowed

 

Have fun!

 

Virustotal scan

findtheflag.rar

Edited November 1, 2015 by Extreme Coders

[GIV]

Stupid patch.

 

findtheflag1.rar

Edited November 2, 2015 by GIV

[Extreme Coders]

@GIV: Good Work.

 

A little hint if someone else is interested in finding the actual flag. It consists of exactly 30 printable ascii characters.

[GIV]

They can do a simple compare of my patched file with original file. Is just a byte patch.

Is a xor and a compare operation and a simple jump to pass the bad boy message.

 

I have searched in memory the bad boy string, put a hwbp on access on the first letter then when it was triggered i looked in the call stack to see from where it was accessed and forward using the stack i have reached the actual check routine.

I have no patience to recompose the original string just i have put a compare to be equal (EAX=0) and so the program jumps always to good boy.

Edited November 2, 2015 by GIV

[SmilingWolf]

The thing is, in an actual CTF you'd need the string. C'mon yer ol' lad, put a little extra effort in this, at least it is not the usual "überpacked" .NET file, too much of that sith has been posted here in the last year...

Edited November 2, 2015 by SmilingWolf

[kao]

flag{Y0u_s0lved_that_r1ght!!!}

 

EDIT: I enjoyed it so much that I think it deserves a small writeup. Coming up in few hours..

Edited November 2, 2015 by kao

[Extreme Coders]

That was quick. I am literally out of words.

 

You actually deserve a prize for this.

[kao]

Here's the writeup: http://lifeinhex.com/solving-find-the-flag-crackme-by-extreme-coders/

[Jasi2169]

Where there is no hope there is KAO

oh not to forget tonyweb

Edited November 2, 2015 by Jasi2169

[Gyrus]

Thank you Extreme Coders, nice challenge.

flag{Y0u_s0lved_that_r1ght!!!}

 

Attachments include

  cleaned (NOPed) executable findtheflag1.p1.rar

  a Mathematica nb file plus its html output Untitled-2.rar

  pseudo-code maincode.txt

[Extreme Coders]

@Gyrus: Excellent work.