Solution to Linch’s Premium CrackMe

1 minute read

The link to this “crack me” can be found here ;) PLAN:- Loading the file in IDA for disassembly IDA complained:

The imports segment seems to be destroyed. This MAY mean that the file was
packed or otherwise modified in order to make it more difficult to analyze.
If you want to see the imports segment in the original form, please reload
it with the 'make imports section' checkbox cleared

It is clear that the file was packed, I loaded it into Exeinfo PE, and it reported that this executable file was created with vbs to exe and gave me a hint. `Check resources for .vbs script , if passworded find MD5 hash inside “P” resource for pass decode’. Checking the resource with CFF explorer RCData/”B” -[lang:0], I found this script there:

@echo off
echo Welcome to Linch's Premium Software
echo Please LogIn with your Account...
echo Username:
set /p Username=
echo Password:
set /p Password=
if %Username%== TheBadGuy243 goto Pwcheck
if %Password%== BadLogin202 goto Right <-----really me="" nbsp="" puzzles="" span="">
echo Wrong Login!
echo Software isn't activated.
pause > nul

Regardless of the fact that I cant find where is Right but it is clear that the username is TheBadGuy243 and the password isBadLogin202


Leave a Comment