Crackmes.one: FindMySecret by pranav

Tools

• IDA Disassembler
• x64dbg

Anti-Debugging

In the main function a thread is being started with a function StartAddress. When we go to the function that the pointer points to we can see there is a function that takes in other functions as parameter.

When we follow the AntiDbg function we see it goes byte by byte of the parameter (function) and checks if there is a Breakpoint (0xCC) and ends when it finds return (0xC3).

Main

The main function uses some tricks to prevent decompilation (at least for IDA 9.2) but we can still see the assembly. After the thread creation a block is executed that is covered later but basically calls one function that is used to create the secret number. Following the jumps we end up at loc_401859 where you are prompted to enter the secret number.

There is a max length check so we know the number cant be bigger then 270F. Afer it passes that check there is a jmp to loc_401897 where the check happens if the entered number is the correct one for that the CheckerFunc is called.

In here we see that the secret number is multiplied by 10000 once.

Secret number

Directly after the antidbg thread is created and cmd is set to 0, the first function that makes the secret number is called at: call eax.

When we follow the function we see the number is being derived from the computors current time using time(0) and stored in ResultNum.

In sub_4015C0 additional calculation is being done where someConst is defined as 3.8 . This function is executed when cmd/ArgList is set to 2 and in total is called 4 times.

With these functions we have everything we need to create a KeyGen for this crackme.

KeyGen

Now the keygen is very simple, using the findings from the calculation functions and the checkerFunc we can simply do the same to get the number the crackme wants.

            
__time32_t v0;

// Calc1
do
{
    v0 = time(0); // Replace
} while (0.0 == (double)((long double)(v0 % 50) / 50.0));

double secretNumber = (long double)(v0 % 50) / 50.0;

// Calc2
for (int i = 0; i < 5; ++i)
    secretNumber = 3.8 * secretNumber * (1.0 - secretNumber);

// Multiply by 10000 like in CheckerFunc
secretNumber = secretNumber * 10000.0;
            
        

The only problem now is even when this is executed a second later then the crackme, the number will be incorrect. But we can simply load the crackme into a debugger and breakpoint on time(), with this we will also bypass the breakpoint checks. After that we copy the value returned from time(). With this the time is accurate and the crackme is beaten!