Results 1 to 7 of 7

Thread: Few of my 'cracking-notes' Share/Save - My123World.Com!

  1. #1

    Few of my 'cracking-notes'

    Hi,

    below you will find few of my 'cracking notes'. Nothing new or special but maybe someone will find it useful.

    In case of any questions feel free to PM me.

    enlil-notes.txt

  2. #2
    ... I am no Expert b0nd.g4h@gmail.com b0nd's Avatar
    Join Date
    Jul 2010
    Location
    irc.freenode.net #g4h
    Posts
    744
    Hi enlil,

    That's really appreciable. How about you create separate thread for each crackMe and post here? That way things would be more organized and readable. Attachments are something which are not read by most and sometimes they got permission issues as well. Let me know if I could be of any help on that.

    Cheers!
    b0nd
    [*] To follow the path: look to the master, follow the master, walk with the master, see through the master,
    ------> become the master!!! <------
    [*] Everyone has a will to WIN but very few have the will to prepare to WIN
    [*] Invest yourself in everything you do, there's fun in being serious

  3. #3
    >> That's really appreciable. How about you create separate thread for each crackMe
    >> and post here? That way things would be more organized and readable.

    Yes, I thought about it. As well as "eee... but I'm new here, so maybe I will not
    post some old-stuff as 100posts to not be banned in a very first day"

    Next time, I'll do that (post-by-case).


    >> Attachments are something which are not read by most
    hehe. that wasn't accident. the reason I've done that was the same as for doing crackme:
    if you want it, you will check it.

    >> and sometimes they got permission issues as well. Let me know if I could be of any help on that.

    I can tell the same as well: if I can help you with anything related to re/malwares/exploitation/crackmes/ctf's,
    feel free to let me know. Maybe I will not know the answer but sometimes is even better
    to find the 'correct path' with someone else, with who you can talk or do some kind of a 'brain storm'

    But it's only 'in my opinion' so... Thanks for the warm welcome.

    Cheers

  4. #4

    weekly cracking challenge

    Hi B0ND,

    It would be great if we can have a weekly cracking challenge followed by a solution, it would be helpful and keeps motivation.

    Regards
    Ravi Teja

  5. #5
    B0nd has the point to make different post for each crackMe. The following crackMe I found really interesting, could please just pass the binary file AD_CM#1.EXE. We can also perform the weekly cracking challenges, the point is who will develop such nice crakMe or we can use any exisiting crackMe. If you have development experience, that would be really nice to start with it.

    Code:
    ---------------------------------------------------------------------------
    	  #00.04 - AD_CM#1.EXE
    
    ---------------------------------------------------------------------------
    
    From my perspective, very interesting case for new-asm-readers. ;)
    So, enjoy:
    
    
    CPU Disasm
    Address   Hex dump          Command                                  Comments
    004010A5  |.  66:3D B90B    CMP AX,0BB9
    004010A9  |.  75 43         JNE SHORT 004010EE
    004010AB  |.  6A 07         PUSH 7                                   ; /MaxCount = 7
    004010AD  |.  68 5C304000   PUSH OFFSET 0040305C                     ; |String
    004010B2  |.  68 B80B0000   PUSH 0BB8                                ; |ItemID = 3000.
    004010B7  |.  FF75 08       PUSH DWORD PTR SS:[ARG.1]                ; |hDialog => [ARG.1]
    004010BA  |.  E8 6F000000   CALL <JMP.&USER32.GetDlgItemTextA>       ; \USER32.GetDlgItemTextA
    004010BF  |.  B8 5C304000   MOV EAX,OFFSET 0040305C
    004010C4  |.  BB 1E304000   MOV EBX,OFFSET 0040301E                  ; ASCII "qWeRtZ"
    004010C9  |.  B9 07000000   MOV ECX,7
    004010CE  |>  8A13          /MOV DL,BYTE PTR DS:[EBX]
    004010D0  |.  3810          |CMP BYTE PTR DS:[EAX],DL
    004010D2  |.  75 18         |JNE SHORT 004010EC
    004010D4  |.  40            |INC EAX
    004010D5  |.  43            |INC EBX
    004010D6  |.^ E2 F6         \LOOP SHORT 004010CE
    004010D8  |.  6A 40         PUSH 40                                  ; /Type = MB_OK|MB_ICONASTERISK|MB_DEFBUTTON1|MB_APPLMODAL
    004010DA  |.  68 09304000   PUSH OFFSET 00403009                     ; |Caption = "ArturDents CrackMe#1"
    004010DF  |.  68 36304000   PUSH OFFSET 00403036                     ; |Text = "Yeah, you did it!"
    004010E4  |.  FF75 08       PUSH DWORD PTR SS:[ARG.1]                ; |hOwner => [ARG.1]
    004010E7  |.  E8 48000000   CALL <JMP.&USER32.MessageBoxA>           ; \USER32.MessageBoxA
    004010EC  |>  EB 1A         JMP SHORT 00401108
    004010EE  |>  66:3D BA0B    CMP AX,0BBA
    004010F2      75 14         JNE SHORT 00401108
    004010F4  |.  6A 00         PUSH 0                                   ; lParam = NULL
    004010F6  |.  68 027D0000   PUSH 7D02                                ; wParam = NotifyCode = MENU/BN_CLICKED..., ID = 32002.
    004010FB  |.  68 11010000   PUSH 111                                 ; Msg = WM_COMMAND
    00401100  |.  FF75 08       PUSH DWORD PTR SS:[ARG.1]                ; hWnd => [ARG.1]
    00401103  |.  E8 32000000   CALL <JMP.&USER32.SendMessageA>          ; Jump to USER32.SendMessageA
    00401108  |>  EB 09         JMP SHORT 00401113
    0040110A  |>  B8 00000000   MOV EAX,0
    0040110F  |.  C9            LEAVE
    00401110  |.  C2 1000       RETN 10
    00401113  |>  B8 01000000   MOV EAX,1
    
    
    
    Well, it looks for me like the string from EAX is compared with EBX.
    Serial-key is in EBX and then it's compared char-by-char with value(s)
    from DL (users-input serial key).
     
    DL compared, loop, next char-value... compared, loop... and so on, until we will
    find a 'pair' which is equal. :)
    
    In that case - 'password is hardcoded' so we can find it during reading the ASM.
    Garage4Hackers bugs for the community , of the community

    We provide IT
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    :
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

  6. #6

    We can use past CTF reverse engineering challanges.

    Hi s,

    If we can find the archives of past reverse engineering challanges of CTF's we can use them. I will check and update this post if i found one.

  7. #7
    Great no problem, it would be helpful get kick start.
    Garage4Hackers bugs for the community , of the community

    We provide IT
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    :
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •