Hasher 2

spbctf

Task: x86-64 PIE keygen crackme with a two-stage licence check — an MD5 gate over selected characters plus a nested threaded state-machine serial validator (obfuscated computed-goto control flow). Solution: hashcat mask attack recovers the 6 group-final chars from a hardcoded MD5, then a concrete Unicorn oracle of check_serial with a loop-detection early-stop drives a greedy per-byte search that forces the remaining 30 chars.