Jerred

Platform: spbctf | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-04-15 | Status: Solved Techniques: input_length_validation, static_disassembly

Summary

Task: a PE32 Windows crackme asks for a serial key and reports only success or failure. Solution: disassembly shows the checker only accepts inputs of length 89, so any 89-character string is a valid serial.

Jerred — SPbCTF Reverse Kids 2.0

Description

Flag is a valid serial. There are many correct flags.

We are given a 32-bit Windows executable and need to provide any serial that the program accepts.

Analysis

Reconnaissance

Basic triage quickly shows this is a small serial-checking crackme:

 bash read-only • copy allowed Copy
file tasks/spbctf/Jerred/jerred.exe
strings tasks/spbctf/Jerred/jerred.exe
objdump -Mintel -d tasks/spbctf/Jerred/jerred.exe

Important strings recovered from the binary:

• Input valid serial key: >
• You are welcome! Now you can use this app.
• Go out of here! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

So the program clearly reads a serial, then prints either a success or failure message.

Disassembly findings

The main validation path is much simpler than a typical keygenme:

1. Read user input into a local buffer.
2. Walk the buffer byte by byte to compute the string length.
3. Compare the final length against 0x59.
4. If the length matches, print the success message.
5. Otherwise, print the failure message.

The critical comparison is:

 asm read-only • copy allowed Copy
cmp ecx, 0x59

0x59 is decimal 89.

No additional checks were identified on the main success path: no character class restrictions, no checksum, and no per-position comparisons. The serial content itself does not matter, only its length. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Because the executable accepts any input whose length is exactly 89 bytes, there are many valid serials. A simple valid answer is 89 uppercase A characters.

Example generator:

 python read-only • copy allowed Copy
#!/usr/bin/env python3

serial = "A" * 89
print(serial)
print(len(serial))

Verification logic:

• if len(serial) == 89 → success
• else → failure

Reproduction

 bash read-only • copy allowed Copy
# Confirm file type
file tasks/spbctf/Jerred/jerred.exe

# Recover user-facing strings
strings tasks/spbctf/Jerred/jerred.exe

# Inspect validation logic
objdump -Mintel -d tasks/spbctf/Jerred/jerred.exe

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Then look for the length walk and the final comparison to 0x59. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍