Crackme for Beginners: Solve Your First One (2026)

What Is a Crackme?

What is a crackme? A crackme is a small program written specifically to be reverse engineered as an exercise. It usually checks a password, a serial number or a license key, and the goal is to understand that check well enough to pass it. Because the author built it to be cracked, solving one is legal and breaks no license.

The tradition goes back decades. The old community site crackmes.de hosted thousands of them until it shut down, and its spiritual successor, crackmes.one, was created so newcomers would still have a place to learn. Most crackmes fall into one of three types:

• Crackme: find the hidden password or flag. The simplest and the best starting point.
• Keygenme: work out the algorithm that turns a name into a valid serial, then write a small program (a keygen) that produces serials for any name.
• Patchme: modify the binary itself so it accepts any input. Only valid when the author says so.

That last point trips up a lot of beginners. Changing one conditional jump so the program always prints "Access granted" feels like winning, but the crackmes.one rules treat patching as an invalid solution unless the challenge is explicitly a patchme. The reason is practical: a patch teaches you where the check is, while a keygen proves you understood what it does.

Why Crackmes Are the Best Way Into Reverse Engineering

Reverse engineering is the CTF category beginners avoid the longest. You are handed a compiled file with no source code, and the first time you open it in a disassembler the wall of instructions looks hopeless. If you are still mapping out the CTF categories, our guide to the six CTF categories shows where reversing sits next to web, crypto and pwn.

Crackmes fix the "hopeless wall" problem in three ways:

• They are small. A beginner crackme often has one function that matters. You learn to ignore the compiler boilerplate and zoom in on the check.
• They are graded by difficulty. crackmes.one rates every crackme from 1 (plaintext strings, simple comparisons) to 6 (custom virtual machines and heavy obfuscation), so you can climb one step at a time.
• They build CTF instincts directly. A typical CTF reversing challenge is a crackme with a flag at the end. The workflow is the same, only the clock is ticking.

Our honest take: if you want to do binary exploitation someday, you cannot skip this. Every buffer overflow starts with reading the program you are about to break.

Set Up a Safe Crackme Workspace

Crackmes on community sites are reviewed before they go live, but they are still executables written by strangers. Run them in a virtual machine, never on the laptop that holds your passwords and photos. A Kali Linux or Ubuntu VM is plenty, and taking a snapshot before each session means you can roll back anything weird in seconds. Windows crackmes belong in a separate Windows VM.

You need surprisingly few tools to start. These are the ones we would install on day one:

Which disassembler? Pick Ghidra. It is free, open source, maintained by the NSA, and its decompiler turns most beginner crackmes into readable pseudo-C. IDA Free and Binary Ninja are excellent, but you do not need to spend money or learn a second interface while the basics are still new. If you want a guided tour of the interface first, the Ghidra chapter of HackerDNA's reverse engineering course walks through the panels you will actually use.

How to Solve a Crackme: The 5-Step Method

Almost every beginner crackme yields to the same routine. Work through it in order, and only move to the next step when the current one stops giving you answers.

1. Run it. Type a wrong answer on purpose and note every message. "Wrong password." is a string you can search for later.
2. Identify it. Run file to learn the format (ELF for Linux, PE for Windows), the architecture (x86-64, ARM64) and whether symbols were stripped.
3. Read the strings. Run strings and look for the messages you saw, plus anything that looks like a password, a format string or a flag.
4. Find the check. Open the binary in Ghidra or objdump, jump to the code that prints the success message, and walk backwards to the comparison that decides it.
5. Confirm it live, then solve it properly. Set a breakpoint on that comparison in GDB and watch the real values. Then write down the answer, or for a keygenme, rewrite the algorithm in Python.

Step 4 is the one that feels scary, and it is where the "work backwards from the success message" trick earns its keep. You never need to understand the whole program. You need to understand the twenty instructions that decide between two messages.

Worked Example: Three Practice Crackmes You Build Yourself

The safest crackme is one you compiled. Below are three short C programs, each one a step harder than the last. Save them in your VM, compile them, then try to forget the source code and solve them like you had never seen it. We ran everything on Ubuntu 24.04 with GCC 13.3, GNU objdump 2.42 and GDB 15.1 on x86-64, so your addresses may differ slightly on another setup.

// level1.c - the password is in plain sight
#include <stdio.h>
#include <string.h>
int main(void) {
    char input[64];
    printf("Password: ");
    if (!fgets(input, sizeof input, stdin)) return 1;
    input[strcspn(input, "\n")] = 0;
    if (strcmp(input, "s3cr3t_b4nana") == 0) puts("Access granted.");
    else puts("Wrong password.");
    return 0;
}

// level2.c - the password is XOR-encoded
#include <stdio.h>
#include <string.h>
static const unsigned char enc[] = {0x2e,0x70,0x34,0x1f,0x29,0x2e,0x1f,
    0x33,0x34,0x32,0x29,0x2e,0x27,0x33,0x00};
int main(void) {
    char input[64], key[16];
    printf("Password: ");
    if (!fgets(input, sizeof input, stdin)) return 1;
    input[strcspn(input, "\n")] = 0;
    for (int i = 0; enc[i]; i++) key[i] = enc[i] ^ 0x40;
    key[sizeof enc - 1] = 0;
    if (strcmp(input, key) == 0) puts("Access granted.");
    else puts("Wrong password.");
    return 0;
}

// level3.c - a keygenme: the serial depends on your name
#include <stdio.h>
#include <string.h>
int main(void) {
    char name[32], serial[32], want[32];
    unsigned int sum = 0;
    printf("Name: ");   if (!fgets(name, sizeof name, stdin)) return 1;
    printf("Serial: "); if (!fgets(serial, sizeof serial, stdin)) return 1;
    name[strcspn(name, "\n")] = 0; serial[strcspn(serial, "\n")] = 0;
    if (strlen(name) < 4) { puts("Name too short."); return 1; }
    for (size_t i = 0; i < strlen(name); i++) sum += (unsigned char)name[i] * (i + 1);
    snprintf(want, sizeof want, "KEY-%04X", (sum ^ 0x1337) & 0xFFFF);
    if (strcmp(serial, want) == 0) puts("Valid serial. Well done.");
    else puts("Invalid serial.");
    return 0;
}

gcc -O0 -o level1 level1.c
gcc -O0 -o level2 level2.c
gcc -O0 -o level3 level3.c

Level 1: The Password in Plain Sight

Run it, fail, then identify it:

$ ./level1
Password: test
Wrong password.
$ file level1
level1: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked,
interpreter /lib64/ld-linux-x86-64.so.2, ..., for GNU/Linux 3.2.0, not stripped

"Not stripped" means function names like main are still inside, which makes the next steps easier. Now the strings. The full output is about 90 lines of library names and compiler leftovers, but look at what sits right between the two messages you already saw:

$ strings level1
...
Password:
s3cr3t_b4nana
Access granted.
Wrong password.
...

That is the whole solve. The compiler stores string literals together in a read-only section, so a hardcoded password tends to land right next to the success and failure messages. This is exactly what difficulty 1 means on crackmes.one, and you will be surprised how often it still works in CTF warm-up challenges.

Level 2: The Hidden Password

Same messages, but this time strings shows nothing that looks like a password. Time to find the check. Disassemble main with Intel syntax, which most tutorials use:

$ objdump -d -M intel --no-show-raw-insn level2 | awk '/<main>:/,/^$/'
    ...
    1263:  mov    eax,DWORD PTR [rbp-0x64]
    1266:  cdqe
    1268:  lea    rdx,[rip+0xd99]        # 2008 <enc>
    126f:  movzx  eax,BYTE PTR [rax+rdx*1]
    1273:  xor    eax,0x40
    1276:  mov    edx,eax
    ...
    1297:  jne    1263 <main+0x7a>
    ...
    12ab:  call   10f0 <strcmp@plt>
    12b0:  test   eax,eax
    12b2:  jne    12c5 <main+0xdc>

Read it backwards. At 12ab the program calls strcmp, and the jump right after picks the success or failure message. Above it is a loop: load one byte from something called enc, XOR it with 0x40, store it, repeat until a zero byte. So the real password is built at runtime from encoded bytes.

You could decode those bytes by hand. It is faster to let the program do the work and read the result in GDB. Breaking on the general strcmp symbol is a trap here, because the dynamic loader also calls it before main runs, so break on the exact call instead. 0x12ab - 0x11e9 (the start of main) is 194:

$ echo AAAA > in.txt
$ gdb -q ./level2
(gdb) break *main+194
(gdb) run < in.txt
Breakpoint 1, 0x00005555555552ab in main ()
(gdb) x/s $rdi
0x7fffffffc400: "AAAA"
(gdb) x/s $rsi
0x7fffffffc3f0: "n0t_in_strings"

On x86-64 Linux, the first two function arguments travel in the rdi and rsi registers. One holds your input, the other holds the decoded password. The author even named it for you.

Level 3: Your First Keygen

Level 3 asks for a name and a serial. There is no single right answer, so a debugger alone would only give you the serial for one name. The goal of a keygenme is to rebuild the algorithm. strings gives a first clue:

$ strings level3 | grep KEY
KEY-%04X

That is a printf-style format: the serial is "KEY-" followed by four uppercase hex digits. Now the loop that computes those digits:

    132c:  lea    rdx,[rbp-0x70]
    1330:  mov    rax,QWORD PTR [rbp-0x78]
    1334:  add    rax,rdx
    1337:  movzx  eax,BYTE PTR [rax]       ; c = name[i]
    133a:  movzx  eax,al
    133d:  mov    rdx,QWORD PTR [rbp-0x78]
    1341:  add    rdx,0x1                  ; i + 1
    1345:  imul   eax,edx                  ; c * (i + 1)
    1348:  add    DWORD PTR [rbp-0x7c],eax ; sum += ...
    134b:  add    QWORD PTR [rbp-0x78],0x1 ; i++
    ...
    1362:  mov    eax,DWORD PTR [rbp-0x7c]
    1365:  xor    eax,0x1337               ; sum ^ 0x1337
    136a:  movzx  edx,ax                   ; keep the low 16 bits

Each character is multiplied by its position (starting at 1), the products are summed, the sum is XORed with 0x1337, and only the lowest 16 bits are kept. Rewrite that in Python and you have a keygen:

import sys

name = sys.argv[1]
total = sum(ord(c) * (i + 1) for i, c in enumerate(name))
print(f"KEY-{(total ^ 0x1337) & 0xFFFF:04X}")

$ python3 keygen.py dana
KEY-10C3
$ ./level3
Name: dana
Serial: KEY-10C3
Valid serial. Well done.

In practice, this is the moment crackmes click for most people. You did not guess anything. You read the logic, rewrote it in a language you know, and the program agreed with you. Ghidra would have shown the same loop as pseudo-C, which is why it becomes your main tool once programs grow past a few dozen lines. Try opening level3 in it and compare the decompiler view with the assembly above.

Where to Find Crackmes

crackmes.one

crackmes.one is the main community library and the place to go after your own practice binaries. When we checked in November 2026, its home page listed 100,861 users, 4,834 crackmes and 6,846 writeups. A few things to know before your first download:

• Every download is a password-protected ZIP. The password is always crackmes.one. The archive keeps the executable from being opened by accident on the way to your VM.
• Use the search filters. You can filter by difficulty (1 to 6), quality rating, language, platform and number of writeups. Start with difficulty 1 to 2, Linux or Windows to match your VM, and at least one writeup so you can check your reasoning afterwards.
• Some crackmes now score points. Auto-validated crackmes print a flag in the format CMO{...}. Submitting it records your solve and awards between 100 and 600 points on the scoreboard.
• Writeups are walkthroughs, not answers. A writeup that only contains the password is rejected. Writing one for every crackme you solve is the best study habit you can build, and it doubles as a portfolio.

CTF archives and guided labs

Beginner CTFs and practice gyms almost always include a reversing category, and those challenges are crackmes with a CTF flag at the end. pwn.college goes further and teaches assembly and reverse engineering from scratch. Our pwn.college beginner's guide explains which dojos to do first.

For a free book to keep open next to Ghidra, Dennis Yurichev's Reverse Engineering for Beginners is still the standard recommendation. It shows the same C code compiled for different compilers and CPUs, which is exactly the skill a crackme trains.

Common Beginner Mistakes

• Running crackmes on your main machine. Reviewed does not mean audited. Use a VM with snapshots, and keep it off your shared folders.
• Jumping to difficulty 4. A crackme with anti-debugging tricks will make you quit. Solve ten difficulty 1 and 2 crackmes before going higher.
• Reading every instruction. Start from the success string and walk backwards. Most of a binary is compiler setup you can safely ignore.
• Patching instead of understanding. Flipping a jne to je works on your copy and teaches you very little. Aim for the password or a keygen.
• Opening the writeup after five minutes. Give yourself a fixed budget, around an hour for an easy one, then read a writeup and rewrite the solution yourself without looking.

Legal and Ethical Considerations

Crackmes are legal because their authors built them to be cracked and published them for that purpose. The skills you build are the same ones malware analysts and vulnerability researchers use every day. That does not make every binary fair game.

• crackmes.one itself bans game cheats, cracks for commercial software and real malware.
• Do not upload someone else's crackme or writeup as your own work.
• Respect each platform's rules on publishing solutions, especially for live CTFs.

Frequently Asked Questions