BinaryShield (Custom VM)

[ra1n]

View File

BinaryShield (Custom VM)

---

This is my first attempt at a binary protector. Currently, the VM has very little protection, so this should be good for those interested in learning about VM-based obfuscation. I intend on uploading new challenges that feature my protector as I add more features.

BinaryShield source code: https://github.com/connorjaydunn/BinaryShield

GOAL:

- You must find the correct key. Simply patching to get a goodboy message is NOT allowed.
- Bonus points for devirt and explanation of your approach.
- MOST IMPORTANTLY, have fun!

---

• Submitter
  ra1n
• Submitted
  09/24/2024
• Category
  CrackMe

 

Edited September 25, 2024 by ra1n

[Washi]

Fun and not too difficult challenge. I always like me some VM crackmes

Valid keys:

  Reveal hidden contents

1859
2418
1638
299902
29763

Had enough fun reversing this so I made a full writeup with disassembler and devirtualized code:

https://blog.washi.dev/posts/binaryshield-vm-crackme/

Edited September 25, 2024 by Washi

[ra1n]

  On 9/25/2024 at 2:45 PM, Washi said:

Fun and not too difficult challenge. I always like me some VM crackmes

Valid keys:

  Reveal hidden contents

1859
2418
1638
299902
29763

Had enough fun reversing this so I made a full writeup with disassembler and devirtualized code:

https://washi1337.github.io/ctf-writeups/writeups/misc/tuts4you/binaryshield/

Expand  

Bravo! Thank you for the writeup. I apologize for the confusion with the multiple keys—it was only supposed to be one! I mistakenly checked if the input matched those constants instead of the current key calculation. Haha! I look forward to sharing my next upload, which will include anti-debugging features. Once again, amazing work!

EDIT: There appears to be a small typo in your lifted disassembly that would imply some of the keys are not correct.

Edited September 25, 2024 by ra1n

[m0rphine]

hi, i am new to devirtualization topic and this challenge was very good for beginners and me.

first, my goal was not just obtain the keys but devirtualize whole function automatically and recompile back to be able to patch it.

i lifted handlers to LLVM IR and recompiled in a new binary to analyze it

this is my final output

i know its a little difficult to read, but at least you can see the correct keys clearly if you look at if statements.

sadly, code crashes at runtime, i dont know why. it will probably take really long time to identify the problem. i dont think i will do that. maybe i might try VTIL instead of LLVM.

i would like to see others approaches on fully devirtualizing this vm. great challange again.