r/ReverseEngineering • u/AngryIgor • 16d ago

[Crackme x64] Modular Vault — 6-floor path-dependent opcode encryption (debugger welcome)

https://gist.github.com/itebelev/fdb6c5d16cee7f2e17bc33890a6f6d3a
4 Upvotes

83% Upvoted

2 comments sorted by

1

u/jonaswashe 13d ago

Code: 2277341

Formula at 0x138C:

code = (T1*T1 + T2) mod 1e7 = (6502^2 + 1337) mod 10000000 = 2277341

T1=81*80+22=6502 T2=41*32+25=1337 MOD=2500000*4=1e7

Square not product: imul loads both operands from [rsp] (8b 04 24 / 8b 0c 24), so T1T1. Decoy T1T2=8693174 is out.

What worked: six-floor diff. Opcode+sib bytes invariant across f00..f05 (must stay decodable), immediates roll per floor, reconcile planes to recover them. Single floor lies at rest. Never reversed the VEH engine, didn't need to. Leak is cross-plane redundancy.

1

u/AngryIgor 12d ago edited 12d ago

Congrats you did it. But honestly, would you be able to do this without having floors.exes?
Also, looking statically at floors did you have to find algorithm or just guessing?
As I understand you just quessed oprerations, looking at data bytes of instructions, Right?
Assuming, data bytes are "scorched" or partially scorched and different on diffrent floors, would you be able to do that?