C/BreakableCrackMe.c at master · gsmithcj/C · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
# include <stdio.h>
# include <stdlib.h>
# include <string.h>
# include <assert.h>
# include <errno.h>
# include <sys/ptrace.h>
# include <unistd.h>

#define LOL 0x14
#define genkey "DapAswd"
#define LIMIT 244

/*
 * [+] Breakable need to be patched first to
 *      could be debbugged
 *
 * root@kmkz-3lrvs/home/kmkz/Breakable# ./breakable
[+] Enter your name : pouetapwal
[+] Enter serial : kikoo
- Username: pouetapwal- Key: kikoo

flag 6D651617373776F736565656D616D6F7375717569757165-2852
* */


 struct data{
   char usr[80];
   char ki[90];
} _data;


int main(int argc, char **argv[]){

/* Routine anti débugg  obfusquée 1 */
char usr[LIMIT]={0};
short int dbg=(0);
char z[LIMIT]=("0x0804924");
char key[26]={0};
char serializ[57]={0x8c ,0x75 ,0x70 ,0x61 ,0x73 ,0x74 ,0x77 ,0x6e ,0x72,
                   0x64 ,0x64 ,0x65 ,0x6c ,0xb1 ,0x6a ,0x6f ,0x52 ,0x64,
                   0x71 ,0x75 ,0x99 ,0x74 ,0x75 ,0x65 ,0x00 ,0x80 ,0x90,
                   0x6f ,0x52};

int byte_ =(0);

  __asm__(
		"xor %eax,%eax \012"
		"xor %ebx,%ebx \012"
		"xor %ecx,%ecx \012"
		"xor %edx,%edx \012"
		"mov %ebx,%ecx \012"
		"inc %ecx \012"
		"mov $0x1A, %eax \012"
		"int $0x80 \012"
	);

if (byte_  <= 0 ){
	printf("Program exited normally. \012");
	return(1);
}


/* Routine anti débugg  obfusquée 2 */
int good=(ptrace(ptrace(PTRACE_TRACEME,0,1,0) < 0));


if(good == -1 ){
	printf("Program exited normally. \012");
	return(1);
}


       /* Saisies utilisateur */
memset( _data.ki, 0 ,sizeof _data.ki);
memset( _data.usr, 0 ,sizeof _data.usr);

fprintf(stdout,"[+] Enter your name : ");
fgets(_data.usr,sizeof (_data.usr)-1,stdin);

fprintf(stdout,"[+] Enter serial : ");
fgets(_data.ki,sizeof (_data.ki)-1,stdin);
/* Fin saisies utilisateur */


_data.usr[10]=( (_data.usr[8]) << 1 && _data.ki[3] ==(LOL) );


/* Routine anti débugg  obfusquée 3 */
long int fget_=(ptrace(ptrace(PTRACE_TRACEME,0,1,0) < 0));

if(fget_ == -1 ){
	printf("Program exited normally. \012");
	return(1);
}

sprintf(key,"%s", _data.usr);


char keyz[27]={0x6c ,0x65 ,0x70 ,0x61 ,0x73 ,0x73 ,0x77 ,0x6f ,0x72 ,
                0x64 ,0x64 ,0x65 ,0x6c ,0x61 ,0x6d ,0x6f ,0x72 ,0x74 ,
                0x71 ,0x75 ,0x69 ,0x74 ,0x75 ,0x65 ,0x00 ,0x00 ,0x90};

                /* assertion anti debug */
assert(fget_ == -1 || !fget_ || byte_ <= 0);
_data.usr[2]=( (_data.usr[3]) ^2);

keyz[22]=(_data.usr[6] + 1 );
keyz[2]=(_data.usr[2] >> 2 + 4);
fprintf(stdout,"- Username: %s- Key: %s \012",_data.usr,_data.ki);


   /* --------------------------------------
    * Routine de generation du Serial Final
    *
    * TODO : Prendre en compte le username
    * pour le serial final ! DONE ?
    *
    * STRIPPING
    * ------------------------------------ */


short cpt=(0);
assert(fget_ == -1|| !fget_ || byte_ <= 0);
printf("flag ",_data.usr);

for(cpt;cpt < 24;cpt++){

	printf("%X",keyz[cpt] | 1); // on peux jouer sur la valeur pour obtenir un autre output
	if(keyz[cpt] ==('\00')){
	    break;
	}
}
int wol=strlen(_data.usr)*286;
assert(fget_ == -1|| !fget_ || byte_ <= 0);
fprintf(stdout,"-%d ",wol-8);
printf("\012");

/* ----------------------------
 * Fin de la routine du Serial
 * ---------------------------*/
/* fake password verification */
int serial=strcmp(_data.ki,genkey);
                 if(serial ==0){
                   	printf("%s",serializ);
                    printf("Program exited normally . \012");
                    return(1);
                 }
                 if(serial != 0){
	                   goto WINNER;
                 }

WINNER:
return(0);
}