Crackmes

A crackme is a binary that validates some input (password, serial, license key) and prints "Correct" or "Wrong". Your job: find the valid input without access to the source code. This is the most common type of CTF reversing challenge, and mastering the methodology here applies to almost every other reversing problem.

Methodology

Initial Triage

file crackme
checksec --file=crackme

strings crackme | grep -iE "(correct|wrong|flag|pass|key|success|fail)"
strings crackme | grep "flag{"

nm crackme | grep -i "strcmp\|memcmp\|strncmp\|check\|verify"
readelf -d crackme | grep NEEDED

ltrace ./crackme test_input 2>&1 | head -30
# Look for: strcmp, memcmp, strncmp

Solving Approaches by Level

# Level 1: flag directly in strings
strings crackme | grep "flag{"

# Level 2: hardcoded comparison visible via ltrace
ltrace ./crackme test_input
# strcmp("test_input", "s3cr3t_p4ss") = -1
#                       ↑ correct password!

# Or with GDB:
gdb ./crackme
(gdb) break strcmp
(gdb) run    # enter any input
(gdb) finish
(gdb) x/s $rsi    # second arg = expected string

Methodology Summary

1. strings → Look for hardcoded flag/password
2. ltrace  → Look for strcmp arguments at runtime
3. GDB     → Set breakpoint at comparison, read registers
4. Ghidra  → Decompile, find algorithm
5. Python  → Reverse the algorithm mathematically
6. Z3      → Solve constraint systems automatically
7. angr    → Symbolic execution for complex logic
8. Patch   → Bypass the check entirely (last resort)

Checklist

• strings | grep flag — fastest first check
• ltrace ./crackme any_input — see strcmp arguments
• GDB break strcmp → finish → x/s $rsi — read expected
• Ghidra decompile → find comparison algorithm
• Python XOR reverse for encoded checks
• Z3 for mathematical constraints
• angr for complex multi-condition checks
• Patch JNE → NOP as last resort

Last updated on Aug 1, 2025