Download whole package here! (includes crackme and this tut)

First check what we gonna have to do: The exercise is to find a valid password which gives us somehow a secret text. To check if we got the correct secret text, we have to go to "http://members.lycos.nl/wietsite/fp.php?x=X" where 'X' is replaced with the secret text. I just chose any word, went to the site, and it just told me that I'm wrong :-( So we know what it's all about, let's start...

Ok, the crackme is coded in Assembler and just 2kb in size... nice! Starting it, we see just one input box and button, that's it. So I just left the input box empty, pressed the 'Go' button and got a really nice exception; so I restarted it, typed in anything, pressed the button and again I got an exception (altough this time it was another one ;-)

Let's crack this one...

So fire up Ollydbg and load our target: at the entrypoint we see after calls to GetModuleHandle and GetCurrentProcess (note that the handle to the current process is saved @ 4030C8). Then a buffer is allocated, we see some calls to MultiByteToWideChar and some structures are filled The window is created with DialogBoxIndirectParamA. The window procedure starts @ 4011A2. Ok, nothing strange till now... Examining it, we easily see that the WM_COMMAND message is handled from 4011CF on (remember, it's the constant 0x111). Then the text from the input box is taken, saved @ 403000 and a loop follows...
Scroll to the end of the loop, we see that there comes a call to WriteProcessMemory.

Hm... let's have a detail look at it: 0x13 bytes from address 403009 are written to 401351 to this process. What, 401351? That's the address after the WriteProcessMemory call! So it's gonna be executed! That's means that the buffer at 403009 MUST contain code!
Ok, 0x13 bytes are written, so the memory from 403009 till 40301C must be executable. If we have some look at the loop, we see that our input string modifies this memory range. Now it's clear why the crackme crashes: our serial produces garbage in the memory buffer which are not valid opcodes.
Also note in the dump window in Ollydbg that right after our memory buffer, at address 403025 there is the string "The Secret Text is: 00000". If we look again at the loop, we see that this string is also modified by our entered password.

At first, I thought I had to choose the password so that the memory buffer 403009 contains 0x90 (just nops). So the crackme would run fine and I could dump the secret text at 403025. Well, I tried it, but it didn't work :-( I visited the discussion board of this crackme at crackmes.de and luckily the user profdracula gave us the hint that in order to crack it, you have to know how to call a messagebox! Ah, ok... we should call a messagebox where we put in the string from address 403025.

Nice, so I decided that my code should look like the following. Note that the code consists of 19 bytes, exactly the number of bytes written by WriteProcessMemory! I think that's a hint, cause we could for example leave the caption blank, but then we would need less bytes.

So our buffer must look like this after the loop has processed our password:

Here is the complete loop:

Note that in the loop the eight seven chars of the password are processed, and the ninth one after the loop. Is the password longer, the other chars are ignored.

Let's examine what is done with the first char:
At 401218 0x5B are subtracted. Then this value is written at 40300A, 40300F and so on... Well our buffer starts at 403009, so at 40300A, 40300F, ... there must be a 0x00. So we get following equation:

For the other eight characters of the password, we do the same: look which value is subtracted/added, at which position in the buffer it's written and which opcode byte is has to be. So we get the following:

So run the crackme, type in the input box "[_CracQ_]" and we get a nice messagebox: "The Secret Text is: greed". So take your prefered browser and go to http://members.lycos.nl/wietsite/fp.php?x=greed and we see the 'good boy' message.

Hm, "[_CracQ_]" doesn't make much sense, "[_Crack_]" look much better. If you try it you'll see it also works: the messagebox text remains the same, but the caption becomes "Check at http://members.lycos.nl/wietsite/fp.php?x=secret_text".
00401353 68 25304000     PUSH CrackMe2.00403025 becomes
00401353 68 3F304000     PUSH CrackMe2.0040303F
So I think this is the real solution, but both work! This was luck!

That was a really nice crackme. Hope you understood what I was talking about :-) Till the next time...

Sunshine, February 2k7

This site is part of Sunshine's Homepage