Thread: XOR challenge

Results 1 to 4 of 4
  1. #1
    Harava's Avatar
    Join Date
    Sep 2013
    Gender
    male
    Posts
    114
    Reputation
    10
    Thanks
    2,989

    XOR challenge

    XOR challenge

    I posted this before, but the thread to wich I replied got deleted. So here it is, my source code crackme:

    Code:
    #include <windows.h>
    
    #pragma comment(linker, "/ENTRY:main")
    #pragma comment(linker, "/DEFAULTLIB:kernel32")
    #pragma comment(linker, "/MERGE:.rdata=.text")
    #pragma comment(linker, "/DYNAMICBASE:NO")
    
    char Input[11];
    char Result[5];
    HANDLE hIn;
    HANDLE hOut;
    DWORD dw;
    
    
    bool Checker(char * Pass)
    {
        __asm _emit 0xf8  __asm _emit 0x63  __asm _emit 0x46  __asm _emit 0x6d  __asm _emit 0xc3  __asm _emit 0x59  __asm _emit 0x30  __asm _emit 0x16
        __asm _emit 0x4b  __asm _emit 0xe9  __asm _emit 0x3b  __asm _emit 0x21  __asm _emit 0x07  __asm _emit 0x55  __asm _emit 0x5b  __asm _emit 0xe9
        __asm _emit 0x0c  __asm _emit 0x25  __asm _emit 0x07  __asm _emit 0x16  __asm _emit 0x40  __asm _emit 0x91  __asm _emit 0x00  __asm _emit 0x1f
        __asm _emit 0x2a  __asm _emit 0x23  __asm _emit 0x06  __asm _emit 0x0b  __asm _emit 0xc3  __asm _emit 0x58  __asm _emit 0x77  __asm _emit 0x08
        __asm _emit 0x14  __asm _emit 0x4f  __asm _emit 0x4c  __asm _emit 0x68  __asm _emit 0x76  __asm _emit 0x52  __asm _emit 0x42  __asm _emit 0xe3
        __asm _emit 0x3b  __asm _emit 0x65  __asm _emit 0x16  __asm _emit 0x55  __asm _emit 0x72  __asm _emit 0xe9  __asm _emit 0x0b  __asm _emit 0x64
        __asm _emit 0x2a  __asm _emit 0x55  __asm _emit 0x61  __asm _emit 0xe3  __asm _emit 0x3b  __asm _emit 0x2f  __asm _emit 0x54  __asm _emit 0x52
        __asm _emit 0x6d  __asm _emit 0xe3  __asm _emit 0x0c  __asm _emit 0x29  __asm _emit 0x02  __asm _emit 0x16  __asm _emit 0x7d  __asm _emit 0xe9
        __asm _emit 0x0b  __asm _emit 0x2d  __asm _emit 0x0a  __asm _emit 0x1c  __asm _emit 0x77  __asm _emit 0xd2  __asm _emit 0x68  __asm _emit 0xe3
        __asm _emit 0x41  __asm _emit 0xe0  __asm _emit 0xb7
        return false;
    }
    void CheckerEnd() {}
    
    int main()
    {
        DWORD StartAddr = (DWORD)&Checker;
        DWORD EndAddr = (DWORD)&CheckerEnd;
        DWORD oP;
    
        hIn = GetStdHandle(STD_INPUT_HANDLE);
        hOut = GetStdHandle(STD_OUTPUT_HANDLE);
        ReadConsoleA(hIn, Input, sizeof(Input), &dw, NULL);
        VirtualProtect((LPVOID)StartAddr, (EndAddr-StartAddr), PAGE_EXECUTE_READWRITE, &oP);
    
        for(DWORD n = StartAddr; n < EndAddr; n++)
           *(BYTE*)n ^= Input[(((n-StartAddr)*n*n)^n >> n)%10];
    
        __asm
        {
            push offset Input
            call Checker
            cmp al, 1
            je Yep
            jmp Nope
        }
        Yep:
        Result[0] = 'Y';
        Result[1] = 'e';
        Result[2] = 'a';
        Result[3] = 'h';
        Result[4] = '\0';
        WriteConsoleA(hOut, Result, sizeof(Result), &dw, NULL);
        return 0;
        Nope:
        Result[0] = 'N';
        Result[1] = 'o';
        Result[2] = 'p';
        Result[3] = 'e';
        Result[4] = '\0';
        WriteConsoleA(hOut, Result, sizeof(Result), &dw, NULL);
        return 0;
    }


    The goal is to figure out the correct password. I wish you luck!
    If you have questions on how this was made / how it works, feel free to ask!
    Recent releases:
    CSPHv3.2




    Code:
    00F38C0E     B8 0610F300    MOV EAX, 00F31006
    00F38C13     C700 208CF300  MOV DWORD PTR DS:[EAX], 00F38C20
    00F38C19     EB FF          JMP SHORT 00F38C1A
    00F38C1B     90             NOP
    00F38C1C     0000           ADD BYTE PTR DS:[EAX],AL
    00F38C1E     0000           ADD BYTE PTR DS:[EAX],AL
    00F38C20     58             POP EAX
    00F38C21    ^EB EB          JMP SHORT 00F38C0E
    Can't see me calling, you hatin'?

  2. #2
          ( ° ͜ʖ͡°)╭∩╮
    Former Staff
    MarkHC's Avatar
    Join Date
    Nov 2011
    Gender
    male
    Location
    127.0.0.1
    Posts
    2,750
    Reputation
    66
    Thanks
    14,529
    My Mood
    Angelic
    Quote Originally Posted by Harava View Post
    Code:
    Result[0] = 'Y';
    Result[1] = 'e';
    Result[2] = 'a';
    Result[3] = 'h';
    Result[4] = '\0';
    WriteConsoleA(hOut, Result, sizeof(Result), &dw, NULL);
    Ugh...

    Code:
    Result = "Yeah";
    WriteConsoleA(hOut, Result, sizeof(Result), &dw, NULL);


    CoD Minion from 09/19/2012 to 01/10/2013

  3. #3
    Harava's Avatar
    Join Date
    Sep 2013
    Gender
    male
    Posts
    114
    Reputation
    10
    Thanks
    2,989
    Quote Originally Posted by -InSaNe- View Post


    Ugh...

    Code:
    Result = "Yeah";
    WriteConsoleA(hOut, Result, sizeof(Result), &dw, NULL);
    Ugh what? You can't do Result = "Yeah". It's a C-string.
    And since I don't have stdio.h included, I can't use strcpy either.

    UGH
    Recent releases:
    CSPHv3.2




    Code:
    00F38C0E     B8 0610F300    MOV EAX, 00F31006
    00F38C13     C700 208CF300  MOV DWORD PTR DS:[EAX], 00F38C20
    00F38C19     EB FF          JMP SHORT 00F38C1A
    00F38C1B     90             NOP
    00F38C1C     0000           ADD BYTE PTR DS:[EAX],AL
    00F38C1E     0000           ADD BYTE PTR DS:[EAX],AL
    00F38C20     58             POP EAX
    00F38C21    ^EB EB          JMP SHORT 00F38C0E
    Can't see me calling, you hatin'?

  4. #4
          ( ° ͜ʖ͡°)╭∩╮
    Former Staff
    MarkHC's Avatar
    Join Date
    Nov 2011
    Gender
    male
    Location
    127.0.0.1
    Posts
    2,750
    Reputation
    66
    Thanks
    14,529
    My Mood
    Angelic
    Quote Originally Posted by Harava View Post
    Ugh what? You can't do Result = "Yeah". It's a C-string.
    And since I don't have stdio.h included, I can't use strcpy either.

    UGH
    Well... I just woke up and already went full retard. I think I'll go back to bed


    CoD Minion from 09/19/2012 to 01/10/2013

Similar Threads

  1. Sig Challenge
    By Jackal in forum Art & Graphic Design
    Replies: 20
    Last Post: 08-22-2007, 06:57 PM
  2. hey this is a challenge for all u mpgh coders out there!!!
    By prox32 in forum WarRock - International Hacks
    Replies: 3
    Last Post: 05-17-2007, 11:18 AM
  3. Challenge Thread
    By arunforce in forum General
    Replies: 7
    Last Post: 03-26-2007, 01:22 PM
  4. A Challenge thread
    By D3ATH ANG3L in forum Suggestions, Requests & General Help
    Replies: 0
    Last Post: 02-09-2006, 08:44 PM