Author Acid_Cool_178
Target 2Sweet Crackme 2.C
Download it from http://2Sweet.tsx.orx 
Public Release  20 March 2001
Author Contact acid_cool_178@hotmail.com
Dedication Goes to 2Sweet and +DaFixer for DeDe
Difficulty Level (1..7) 3 ( Easy-Medium)
Tools Required DeDe (I'm are using version 2.50)
Download it from http://www.protools.cjb.net 

 

Introduction
 

Back in the keygenning skills and I made it again.... I founded back my DeDe tool and worked out some new things, I'm still working on another crackme, and it's more fun ;) alotta work on me.... hehehehehe, I love it to the maxxxx.... 
 

Tutorial
 

This crackme have one name and serial, we will keygen this crackme so we have to understand the algorithm on this app, that's why +DaFixer have made DeDe, it's so easy to use that MS can cry... 

And now you will see this, and here is also the debugging code for us :) The Serial algorithm is in here....

00442205   64FF30                 push    dword ptr fs:[eax]
00442208   648920                 mov     fs:[eax], esp
0044220B   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TForm1.Edit1 : TEdit <-- Gets the Name
|
0044220E   8B86D0020000           mov     eax, [esi+$02D0] <--EAX == Name

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets the name
|
00442214   E8CB0FFEFF             call    004231E4 <-- Executes the function
00442219   8B45FC                 mov     eax, [ebp-$04] <-- EAX == Name 

* Reference to: system.@LStrToPChar;
|
0044221C   E8D719FCFF             call    00403BF8

* Reference to: sysutils.StrLen(System.PChar):System.Cardinal;<-- Gets length of name
|
00442221   E89E56FCFF             call    004078C4 <-- executes the function
00442226   8BC8                   mov     ecx, eax <-- ECX == Length of name
00442228   BB01000000             mov     ebx, $00000001 <-- EBX == Counter 1
0044222D   B801000000             mov     eax, $00000001 <-- EAX == Counter 2
00442232   3BC1                   cmp     eax, ecx <-- Compare Length of name with ECX
00442234   7F0F                   jnle    00442245<-- Jump if EAX == less than Counter 2
00442236   8B55FC                 mov     edx, [ebp-$04] <-- EDX == Name
00442239   0FB65402FF             movzx   edx, byte ptr [edx+eax-$01] <-- Takes one char of the name
0044223E   40                     inc     eax <-- Increases EAX
0044223F   03DA                   add     ebx, edx <-- EBX == EBX+EDX
00442241   3BC1                   cmp     eax, ecx <-- IF all chars are done then
00442243   7EF1                   jle     00442236<-- skip this jump
00442245   8BC3                   mov     eax, ebx <-- EAX == the result if the calculation
00442247   C1E004                 shl     eax, $04 <-- SHL EAX,4
0044224A   03C3                   add     eax, ebx <-- EAX == EAX + EBX
0044224C   8BD8                   mov     ebx, eax <-- EBX == EAX
0044224E   8D55F8                 lea     edx, [ebp-$08]
00442251   8BC3                   mov     eax, ebx

* Reference to: sysutils.IntToStr(System.Integer):System.AnsiString;overload; <-- Convert the HEX to ASCII Decimal
|
00442253   E8E053FCFF             call    00407638 <-- Executes the function
00442258   8B45F8                 mov     eax, [ebp-$08] <-- EAX == Result of the conversion
0044225B   50                     push    eax
0044225C   8D55F4                 lea     edx, [ebp-$0C]

* Reference to control TForm1.Edit2 : TEdit <-- Focus on the serial field
|
0044225F   8B86D4020000           mov     eax, [esi+$02D4]

* Reference to: controls.TControl.GetText(TControl):System.String;<-- Gets the serial
|
00442265   E87A0FFEFF             call    004231E4 <-- Executes the function
0044226A   8B55F4                 mov     edx, [ebp-$0C] <-- EDX == serial
0044226D   58                     pop     eax

* Reference to: system.@LStrCmp; <-- Compare the serials
|
0044226E   E8D118FCFF             call    00403B44 <-- Executes the function
00442273   750C                   jnz     00442281 <-- jump if the serial was wrong

* Possible String Reference to: 'WELL DONE !' <-- The good message
|
00442275   B8C4224400             mov     eax, $004422C4 <-- EAX == the good message

* Reference to: dialogs.ShowMessage(System.AnsiString); <-- Shows the good message
|
0044227A   E845F9FFFF             call    00441BC4<-- Executes the function
0044227F   EB0A                   jmp     0044228B <-- Jump to the end of the routine

* Possible String Reference to: 'INCORRECT PASSNUMBER'<-- Bad message
|
00442281   B8D8224400             mov     eax, $004422D8 <-- EAX == Bad message

* Reference to: dialogs.ShowMessage(System.AnsiString); <-- Shows the bad message
|
00442286   E839F9FFFF             call    00441BC4 <-- Executes the function
0044228B   33C0                   xor     eax, eax <-- EAX == 0 
0044228D   5A                     pop     edx
0044228E   59                     pop     ecx
0044228F   59                     pop     ecx
00442290   648910                 mov     fs:[eax], edx

Lets take one small example in here

Name == AcidCool

Now the length of the name is 8 so it will be 8 loops for us to take 

Loop1
A == 41
41 + 1 == 42

Loop2
c == 63
42 + 63 == A5

Loop3
i == 69
A5 + 69 == 10E

Loop4
d == 64
10E + 64 == 172

Loop5
C == 43
172 + 43 == 1B5

Loop6
o == 6F
1B5 + 6F == 224

Loop7
o == 6F
224+6F == 293

Loop8
l == 6C
293 + 6F == 2FF

After Loop8 so is 2FF the result from every char on the name plus ONE.

Take the result and so one SHR,4 and then my result was 2FF0

Now we got two values, 2FF and 2FF0, they is added together'

2FF + 2FF0 == 32EF

32EF to decimal and you have your serial... Mine was  13039 and it worked for the name :)

 

 
Final Thoughts
 

I got the idea at one example from NeO'X'QuiCk  and that really roxx dyed. I have your tutorials man, keep up the good and fantastic work !!


 
Greetings to...


Special Greetings: 
LaZARuS for he's great tutorials....
+DaFixer for DeDe
The Cracking Answer for not even bugging me for writing or cracking anything, that group roxx!!!! You will get alotta work from me now soon :D
NeO'X'QuiCk  for your spirit and ideas on working.

Groups:  HF, ID, TCA, GC, TMG

Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper, CD_Knight and all the rest that i have forgotten
 

The end.
Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.