How I Wrote a Script that Cracks Code Automatically

Reverse engineering is a great way to learn about how computers work. Whether its malware analysis or just solving some problems, reverse engineering is a fun way to enhance your knowledge of computers. In today's video, we reverse engineer a problem from crackmes.one and use an interesting technique.
🏫 COURSES 🏫 Learn to code in C at lowlevel.academy
🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒
Blue Fox: Arm Assembly Internals and Reverse Engineering: amzn.to/4394t87
Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation : amzn.to/3C1z4sk
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software : amzn.to/3C1daFy
The Ghidra Book: The Definitive Guide: amzn.to/3WC2Vkg
🔥🔥🔥 SOCIALS 🔥🔥🔥
Low Level Merch!: lowlevel.store
Follow me on Twitter: / lowleveltweets
Follow me on Twitch: / lowlevellearning
Join me on Discord!: / discord

[@afra1d828]

nice

[@catatrophicalist]

nice

[@cslearn3044]

nice

[@jommeez]

nice

[@zirgaoec3784]

nice

[@grandmakisses9973]

nice

[@mouradlaraba]

even if i didn't understand anything, all i could to say is that the humanity is still good that person like you still exist, thanks a lot

[@rawallon]

idk man, he's writing P*thon

[@n0o0b090lv]

This ain't low level chanel this is high level chanel I learn a lot Also thx LLL

[@basedfacistman]

chanal

[@n0o0b090lv]

@@basedfacistman you see... FAST LOOK AN ALIEN Nah just a bird, oh look chanel. I wonder what happened

[@vnc.t]

*channel

[@n0o0b090lv]

@@vnc.t the n went on vacation

[@ProfessorThock]

LLL feels more Supreme than Chanel

[@cyberpunk1618]

2:55 in and already 100% worth watching. Knowing I can use Ghidra without migraines is such a performance booster.

[@coffeegonewrong]

Thanks for increasing the font size LLL 📱

[@sarimbinwaseem]

Whole thing went above my head but I still watched... Soon it will go in my head... IDK when

[@iwakeupsad]

Totally. So often for me, understanding comes through the side door unannounced.

[@sarimbinwaseem]

@@iwakeupsad haha.. yeah.. unexpectedly..

[@EmberDRG]

thank you for all these vids, they helped me with the basics of reverse engineering. I'm currently working on reverse engineering a ps3 game and it's been incredibly fun so far

[@Pr0xima_audio]

MGS4?

[@EmberDRG]

@@Pr0xima_audio NieR : Gestalt

[@Damqq]

Honestly this is pretty interesting, I NEED MORE OF such content PLEASE.

[@driden1987]

Looks like a lot of fun once you understand what's going on and know ways you could tackle the proble

[@MyCodingDiarie]

I've never commented on a video before, but I had to for this one. It's that good!

[@patriciopage6579]

How is it only now I find this gem of a channel? Dang youtube

[@AgentXegy]

bro I could watch this every day that was awesome

[@driden1987]

Thanks for zooming in!

[@MyCodingDiarie]

Great video! Very informative and well explained.

[@m1geo]

Nicely done, Mr LLL.

[@IsaacNewTom22]

Thank you, LLL, the font size saved me :)

[@titaniumtomato7247]

8:40 I am not a fan when people make negative comments about someone's use of a tool to complete a task. Programming doesn't need more elitism or stupid battles.

[@arjix8738]

I read your comment before watching that part and I totally got the wrong idea lol Thought you meant that no-code "hackers" should not be looked down upon. To which I disagree. But by "tool" you were referring to the choice of language, to which I agree, hacking is a mess either way, the choice of language should not matter as long as it does the job.

[@stefanalecu9532]

I just assumed it's a running joke within the LLL community (especially since he's known for being a C shill, for obvious reasons)

[@P-G-77]

Awesome work !

[@YourPocketTiger]

I love this channel.

[@quietusplus1221]

I have some experience with coding. The further this went on my head started spinning though. This is on another level, quite interesting ^^

[@HypeLobbiesHD]

I love your merch, I have the mousepad and the t-shirt, do you have any other plans for more reverse engineering or low level related merch? I would totally buy more

[@lazzalicious6220]

The man, The myth, The legend. Found you again

[@iagosrodrigues]

I loved the video; I didn't understand anything, but it was an excellent video.

[@adershvarshnei5198]

thanks for increasing the size mr lll :)

[@DropShotPat]

I wasn't worried about the empty boxes, until you said something LOL.

[@AgentKent]

Thanks LLL

[@gringle8578]

Cool, next do Denuvo. Let's see how good you are!

[@baranjan6969]

Ngl I am pretty new to low level stuff but I recommend running it a bit first before even running strings

[@IZ4HDM_Chris]

Thanks for the Font LLL!!!!

[@Armstrong1781]

you are the best

[@terry-]

Great!

[@icankickflipok]

Thanks LLL.

[@EnderMega]

Thats how you know he is a _real manly_ C/C++ programmer, he apologies for using Python, and as a fellow C/C++ programmer I forgive you. Jokes aside, good video!!!

[@Djay0Epizode]

Hey , very nice intro to angr, i have a bit that i didn’t get is why the first try with the 32.8 bit key space reached in the simulator the last address ? That for me doesn’t yet click

[@makebreakrepeat]

Dark mode, let's go!

[@Ni7ram]

yes, yes.. of course i understand all this

[@sassywoocooo]

we finally got ghidra in dark mode

[@Subcode]

Can you make a video on how this would work when an application also has a DLL etc? ive tried this once on an application with a DLL and it got very confusing, really couldnt figure any of it out.

[@monterraythehomeless]

I needed the font size increase and I'm on desktop lol. Thanks LLL

[@kcnl2522]

Terminal looks neat, what are you using?

[@yahsprut]

what if the binary was built in something else like Rust for example? whould then Ghidra reverse engineer it to C or to Rust?

[@logiciananimal]

Angr looks really neat. I suppose in some cases one runs into formal undecidability. How does it "cheat'"?

[@luketurner314]

For anyone here new to Python, if __ name __ == "__main__": main() prevents the main function from running when you import the file/script somewhere else. If you call a function after defining it without this check, it will run even if the file is imported, which you usually don't want Edit: had to insert spaces between the underscores and name because YT thought I wanted it italic. In actual code, it would be 2 underscores, name, 2 underscores (no spaces between); sometimes read as "dunder name" (concatenating/abbreviating "double underscore" to "dunder")

[@asseenontv247]

Do you have any recommendations on books that are useful desk references for this stuff?

[@saulgoodman6710]

Great video, I'm new to this stuff. couple of doubts, when giving the address of the good and avoid case, why is only 4byte address is provided instead of entire address from memory map? secondly, how the hell do you learn all there stuff? since there are multiple libraries/tools.concepts used just for one problem. Impressive btw!

[@Codingwannabe-cw1yd]

Thx lll for zooming in

[@hakushakudoa283]

Thanks triple o

[@RigoVids]

Thanks tripple el

[@outtakontroll3334]

this is some dark art shit- only able to follow a little of it, but interesting

[@cherubin7th]

I am looking forward, when we can take a binary and automatically turn it with AI in beautiful source code with comments etc.

[@dtikvxcdgjbv7975]

You unbaked the bread!

[@zxcvb_bvcxz]

So *why* does angr have issues with stdin and how were you able to work out the fix?

[@SkibidiEugensson]

Why - just speculating here, because cpp streams are weird. How - he has emulated the result of the text input himself, he put the string pointer on the stack (this is exactly what that cpp function does after fetching the text), and he has skipped the stdin function.

[@maz5232]

Hi please make more

[@z8den]

why on earth do you not have the link to the cracksme in the description man

[@secret_7025]

Low level programming is the hardest my bro ReSearch about it.

[@JM-is1vf]

Thanks for your channel. I would love it even more without the background music.

[@oliverpasquesi8068]

Can you do a Ghidra tutorial pls?

[@GameBacardi]

...I need practise "hello world!" again, 60th time

[@hoteny]

cool. now how do i guess what a weird 8 byte value does?

[@Vazzible_gaming]

How do i find the CTF program, can you link it to me so I can do all the steps myself?

[@hyperplano]

Waiting for LLL x LaurieWired video :)

[@boenrobot]

14:37 - Hold up. Where did these magic hex numbers come from? Why those offsets? Can they be determined in a cleaner way, rather than hard coded like that?

[@user-bp6xz6ll9t]

Did you find out this part? also need help here!

[@theman1860]

I noticed that too. Didn't he say -0x34?

[@blehbleh9283]

Symbolic Execution 🔥🔥

[@braveitor]

When machines take over us, I hope you speak for us all as you know their native language. Interesting to watch, don't hava a clue about how anyone can learn those skills... :D

[@SadKris]

the a/v desync lmao

[@monad_tcp]

Is scanf still using self modifying code or something ?

[@llmnr3xp0sed]

I'm curious how angr works with ASLR enabled.

[@nomio_o]

When running with correct permissions you can choose to disable ASLR for a spawned process which is likely what angr does. GDB uses the "personality" syscall to do this with the flag ADDR_NO_RANDOMIZE.

[@llmnr3xp0sed]

@@nomio_o ah, good to know.

[@user-bp6xz6ll9t]

why the -0x58? where does it come from?

[@ErikBongers]

Can you crack how to exit vim?

[@rudymoralesjr]

I need to learn how to do this proficiently so I can hack car ECUs for tuning. They made it so hard to tune cars these days...

[@RandomGeometryDashStuff]

do you use computer with arm cpu?

[@veritas7010]

Now crackmes are cool but whos gonna actually have good info on compiling osx/xnu kernel, modifying kernel/writing a kernel driver to disable debugging detection, bypass address randomization. What for? Oh yeah, just to bypass debug detection and also have a way to dump consistent traces. And just to begin on actually getting progress with 20mb+ binaries

[@AndrewOverthrow]

Thanx Triple L

[@rallokkcaz]

LFG!!!! LLG GANG GANG!

[@nsg650]

Wait are you a cuber as well?

[@UnrealEngine_Master]

nothing is clear, but very interesting 🤠

[@MenkoDany]

There's a piece of abandoned niche commercial software which I'd love to crack for archival purposes. Will this work on it? It's written in Delphi and it can be activated offline even though there was an internet activation option (which obviously doesn't work anymore). There is version 3.x which is still being sold even though there were no updates for 8 years or any activity from the dev whatsoever. Thing is, version 3.x is a joke. Well, 2.x was an actual joke, not worth a penny, and 1.x is the legendary version which I'd like to crack. I believe it would still be used today if the dev released a 64bit version like he promised :( The released version crashes way too often because of the ram limitation.

[@a_f_a_b]

Man you don't have to apologize for python. You don't have to apologize for anything!^_^

[@danielrubin3649]

Tack 3xL

[@VINICIUSMOURACARDOSO]

how can I change ghidra to dark mode?

[@semitangent]

Thanks triple L - in the chat!

[@almightyhydra]

Meh, automating the reverse engineering takes the fun out of the problem :p if each of those functions was only checking one of the bytes, you could solve each fairly simply, I'd imagine.

[@vsevolodalipov4375]

May be a dumb question, but why not brute force it instead?

[@wrathofainz]

Someone should write an ANGR-y UI for gui people

[@catatrophicalist]

do you prefer intel or at&t syntax?

[@grandmakisses9973]

intel of course

[@godnyx117]

@@grandmakisses9973 Based opinion

[@atijohn8135]

intel addressing syntax and at&t argument order ("mov rax (to) rcx" makes more sense than "mov (to) rcx: rax")

[@godnyx117]

@@atijohn8135 The thing is, binary instructions follow the intel syntax. So, especially for those who create compilers, the AT&T syntax is confusing, even tho it makes more sense...

[@flyinginthedark6188]

AArch64

[@shteatinggrin]

It’s so weird knowing that the NSA has a program named after the Godzilla monster

[@VivekYadav-ds8oz]

Remember that it's still nerds inside NSA that are responsible for creating and maintaining this. If they can get away with it, they will.

[@shteatinggrin]

@@VivekYadav-ds8oz Ofc, every major tech system has been built up and maintained by nerds. It’s still pretty wild regardless

[@konfushon]

W in the sHaT!

[@dtikvxcdgjbv7975]

The magic starts at 15:44 😃

[@ffeliziani]

Wait, how are you running arm code on your machine?

[@tronosgamingwizard]

perhaps a VM

[@ffeliziani]

@@tronosgamingwizard does ghidra run on ARM? I guess with the magic of editing (or ssh) he could be on different machines

[@tronosgamingwizard]

@@ffeliziani I'm unable to answer this one, mate.

[@ffeliziani]

Sorry yeah the Q should have been for @lowlevellearning

[@yurilsaps]

I didn’t like that was necessary to use angr to solve the challenge

[@katchen2626]

what does SAT mean?

[@LowLevelLearning]

satisfiability solver

[@christianremboldt1557]

i love you

[@christianremboldt1557]

Context: I am interested in low level coding and cyber security. I've learned to compute RSA with a calculator and I am learning to use ASM and reverse enineering. You are on a level I want to get to. And I love learning from your Video. I started studying Computer Science and I'm working at an IT job. The IT Job doesn't really teach me about the low level stuff and the university only teaches computer architecture, some algorithms and high level programming (and C). But you can teach me what I ACTUALLY want to learn

[@billy-cg1qq]

That angr math solver didn't make any sense lol

[@SuperKingtofu]

Thanks triple L!

[@grandmakisses9973]

ghidra???? why dont you use GDB like cool people do

[@mail2toan]

I can't focus beyond those empty boxes ... Ugh 😅

[@spacebunsarah]

Thanks LLL. Still needs to be bigger for my blind ass 😂

[@juststudying1019]

a prerequisite for this video is ReactJS

[@LowLevelLearning]

Literally no lol

[@juststudying1019]

😂😂😂😂@@LowLevelLearning

[@tablettablete186]

​@@LowLevelLearningTrue, it is actually VueJS! 😂

[@Scriabinfan593]

Thanks triple L

[@danielvalle8875]

I heard they got raided by Jason Statham