search

Crackmes.one

My write-ups for challenges from the Crackmes.one platform. Updates will follow as I solve more challenges.

hashtag
Dry Tau Mac KeygenMe One

Desc: The algorithm is deterministic—same name always produces the same key. Magic constants are used in the hash calculation. The name is converted to uppercase before processing. Both key value and checksum depend on the name. Look for hexadecimal constants like 0x1337BEEF, 0x85EBCA6B, 0xDEADBEEF.

We've given the macho x64 binary

And we open the binary to see what's going on:

We know to get the valid one, it needs 2 correct input, the name and license key. So, we can open up our decompiler apps, in this case Im using IDA.

From that, I can find the main validation logic is located inside AppDelegate.validateKey(_:for:).

This function receives:

  • The license key as the first argument

  • The name as the second argument

This function returns a boolean value, indicating whether the key is valid or not.

From the decompiled Swift code, the following checks are applied:

  • The license key is converted to uppercase

  • All - characters are removed

  • The key must be exactly 16 characters

  • The key must contain only hexadecimal characters (0–9, A–F)

If any of these checks fail, the function immediately returns false. After passing the initial validation, the license key is split into two parts:

Each part:

  • Is exactly 8 hexadecimal characters

  • Is parsed as a 32-bit integer (base 16)

Before any computation:

  • The name is converted to uppercase

  • The UTF-8 bytes of the name are processed sequentially

This means the license key is fully name-dependent.

First Part

The first hash uses a custom rolling hash with magic constants. Initial value:

For each byte c of the uppercased name:

After processing all characters:

This value is stored as:

The result of the first hash is then mixed again using a Linear Congruential Generator. The algorithm iterates over the name bytes and applies:

This stage produces:

This step is similar to the rand() implementation used in libc. Classic PRNG vibes.

Second Part

At the second stage, the application validates the key using this equation:

Rearranging the equation gives:

This shows that:

  • part1 can be chosen freely

  • part2 is fully determined by the name and part1

This makes the algorithm reversible and allows us to generate valid keys.

Solver

And this one is to recompute the algorithm to find the license key based on the username.

Conclusion

The license algorithm is deterministic and fully reversible. The key is strictly bound to the user name and uses multiple hash stages with magic constants to obscure the logic. No cryptographic primitives are used, only arithmetic operations and PRNG-style mixing. This makes the challenge suitable for keygen creation once the validation logic is fully understood.

PreviousC2C CTF 2026 QualsNextHolmes CTF 2025

Last updated