---
# System prepended metadata

title: StillAching's CrackMe
tags: [Crackmes]

---


# StillAching's CrackMe

:::info
Author: StillAching
Language: .NET
Difficulty: 5.0
Quality: 5.5
[Link](https://crackmes.one/crackme/66f46d5110703232965559ae)
:::

## Execute

![image](https://hackmd.io/_uploads/B18PW_AHJx.png)

## Analyze

First check whether this program has **packer or protecter** by `Detect It Easy`.

![image](https://hackmd.io/_uploads/SJoO__RBke.png)

The main idea is:
Open with IDA and I want to find out where does the text print out and where to get user input. After finding user input we can follow the flow to find the ==password encypt method== or ==password compare function==.

### Finding Where Text Print Out And Get User Input

Set the breakpoint at the **start** of program.

![image](https://hackmd.io/_uploads/H1z3C_CSJe.png)

Start debugger and keep pressing `F8` to step over untill we find out which call function print out the text. So we can find that function is call `sub_7FF60C62A210()` and we need to set another breakpoint on this function and restart the debugger.

![image](https://hackmd.io/_uploads/r1jLJtArkg.png)

This time we use `F7` to step into function `sub_7FF60C62A210()` and do the same thing by using `F8` step over until find the function that print out the text.

![image](https://hackmd.io/_uploads/r1u3gF0rJl.png)

By repeat doing the same thing until we find the real function that print out the text. The real function is call `sub_7FF60C5D74A0()`.

![image](https://hackmd.io/_uploads/ry9XHYArJe.png)

In this function after calling the `WriteFile` it will print out the text.

![image](https://hackmd.io/_uploads/HkpPIKAr1g.png)

From the document we can see the second `lpBuffer` store the pointer to what to print out.

![image](https://hackmd.io/_uploads/rJlYDY0rkl.png)

Checking what `v12` store we can get the text. So we can first rename function `sub_7FF60C5D74A0()` to `Print`.

![image](https://hackmd.io/_uploads/r1IUdF0Bye.png)

Keep finding where user can input by using `F8`. Then I the program let user input at the function `sub_7FF60C5D7970()`.

I found something interest here. Before calling the function `sub_7FF60C5D7970()` has another function `sub_7FF60C5D7990()`.

![image](https://hackmd.io/_uploads/rk5BctRSkx.png)

By repeat running debugger I find out after calling function `sub_7FF60C5D7990()` it will print out the text and I start wondering what is the parameter for this function.

After clicking the `unk_7FF60C63EEB8` I find the text under it. And this is exactly what print after calling this function.

![image](https://hackmd.io/_uploads/SykBy5RHkx.png)

We can see in this function it call many `sub_7FF60C5D7990()`. So I keep changing those word start by `unk` to what it will actual print and changing the `sub_7FF60C5D7990()` to `Output()`.

![image](https://hackmd.io/_uploads/H1NAJc0Byg.png)

![image](https://hackmd.io/_uploads/rJpTxcArJe.png)

### Finding Password Checker Function

After we changing the name of function we can focus on the `Line32 - 36`. If `sub_7FF60C5DD8D0(v1, v9)` return **0** then this is condition will be ==ture== (due to it has `!` at the bdgin) and print the `invalid password`. So we must let function `sub_7FF60C5DD8D0(v1, v9)` return ==1== to print the `correct password`.

Before starting we can change the name of this function to `password_checker`.

![image](https://hackmd.io/_uploads/Hk1kN9CBke.png)

Start analyzer `password checker`. We can find out it is pretty easy, if `a1 == a2` then it will return ==1== which is we hope.

![image](https://hackmd.io/_uploads/By2X45ASJg.png)

## Solve

Run the debugger again and then check what is inside the `a1` and `a2` in `password_checker(a1, a2)`.

`a1` is user input.

![image](https://hackmd.io/_uploads/S1rGr5RrJx.png)

`a2` is the ==password==.

![image](https://hackmd.io/_uploads/H1kZS5AS1e.png)

Check is this password correct.

![image](https://hackmd.io/_uploads/SkFoH5ArJe.png)

## Password

`StillAching@CrackMes.one`

## Extra Finding

I have a interest finding that there is function for delete the space at the `start` and `end` (Line19).

![image](https://hackmd.io/_uploads/SJLBL5RSyl.png)

We can verify by add the space at the start and end when we input the password and is still print the `correct`.

![image](https://hackmd.io/_uploads/rkw7D9AByx.png)

## Note

[WriteFile document](https://learn.microsoft.com/zh-tw/windows/win32/api/fileapi/nf-fileapi-writefile)
