Crackmes.one [TrynaToBe6for6Def's My First Crackme] Writeup

Technical overview for the [TrynaToBe6for6Def’s My First Crackme] Crackmes.one room. Room here: TrynaToBe6for6Def’s My First Crackme

Ghidra

Extract and open the exe:

I looked for main, but that was not present. Ghidra did find entry, and it is where we will start:

I think this is where we start, it takes in 4 parameters and then calls a function FUN_140... with them!

We get dropped into a pretty big function, luckily ghidra made some comments saying which calls return nothing, my guess is to trace the one that actually has a return:

This one does, lets move forwards and see where it brings us.

After many dead ends, I finally find where the logic brings us:

From here, it looks like we are close, and from here I try to understand the password logic:

Ok, so I kept tracing the functions until I found this:

From there, went through naming vars until we found the pass_checker func:

From there, the in_checker func led us to:

From here, we find the final logic!

The decoder XORs 13 bytes at DAT_1400030e4 with 0x2a to build the expected password at runtime, then pass_checker strcmps your input against it.

To get those values, I did:

I originally tried the plain ascii column, but the second byte (0x19) is non-printable, so I tried to get the flag from hex.

In Cyberchef:

And we found the answer, nice.

Thank you for reading!

(AI disclosure, I used Claude as a hint-giver while learning Ghidra. It helped me interpret decompiler output and suggested CyberChef for decoding, but didn’t give me the answer.)