https://www.r4mnesia.xyz/reverse/ Recent content on Yachay Hugo -- gohugo.io en-us Mon, 15 Dec 2025 15:55:31 +0100 https://www.r4mnesia.xyz/reverse/crackme1/ Sat, 13 Dec 2025 14:57:14 +0100 https://www.r4mnesia.xyz/reverse/crackme1/ <p>Analysis of a 64-bit Windows PE executable, tracing back step by step from the entry point to understand how the program processes user input, using assembly language, the internal workings of PE sections, and deliberately discreet validation logic, revealing a simple but clever mechanism typical of small reverse engineering challenges.</p> <h1 id="windows-pe-reverse-engineering--crackme-1">Windows PE Reverse Engineering – Crackme #1</h1> <h2 id="infos">Infos:</h2> <ul> <li><strong>Executable name:</strong> crack_me.exe</li> <li><strong>Format:</strong> PE32+</li> <li><strong>Architecture:</strong> x86-64 Windows</li> <li><strong>Sections:</strong> 3 sections</li> <li><strong>Executable:</strong> Console</li> </ul> <h2 id="techniquesconcepts-used">Techniques/Concepts used</h2> <ul> <li>RIP-relative addressing to access data without an absolute address</li> <li>Data stored directly in the <code>.text</code> section (inline data)</li> <li>Mapping table indexed via a bitwise mask (<code>AND 0x7</code>)</li> <li>Verification loop combining user input and an internal table</li> </ul> <p>I use PE-bear, which analyzes files in PE (Portable Executable) format.</p> https://www.r4mnesia.xyz/reverse/crackme2/ Sun, 14 Dec 2025 12:21:36 +0100 https://www.r4mnesia.xyz/reverse/crackme2/ <p>Step‑by‑step analysis of a 64‑bit Windows PE executable, focusing on entry point analysis, runtime initialization, stack frame inspection, and conditional branching to understand how user input is validated in a basic crackme challenge.</p> <h1 id="windows-pe-reverse-engineering--crackme-2">Windows PE Reverse Engineering – Crackme #2</h1> <h2 id="infos">Infos:</h2> <ul> <li><strong>Executable name:</strong> 3outof6.exe</li> <li><strong>Format:</strong> PE32+</li> <li><strong>Architecture:</strong> x86-64 Windows</li> <li><strong>Sections:</strong> 19 sections</li> <li><strong>Executable:</strong> Console</li> </ul> <h2 id="techniquesconcepts-used">Techniques/Concepts used</h2> <ul> <li>RIP-relative addressing to access data without an absolute address</li> <li>DLL imports &amp; IAT (Import Address Table)</li> <li>Environment dependency awareness</li> <li>CRT / Runtime initialization analysis</li> </ul> <p><strong>CRT (C RunTime)</strong> all code automatically added by the compiler. <strong>RIP</strong> = address of the next instruction, used for relative addressing in x86‑64.</p> https://www.r4mnesia.xyz/reverse/dark_comet/ Tue, 16 Dec 2025 18:43:24 +0100 https://www.r4mnesia.xyz/reverse/dark_comet/ <h1 id="in-progress">In progress</h1>