Author Acid_Cool_178
Target StealthFighter's Crackme No.1
Download it from http://www.setalthfighter.cjb.net
Public Release  18 Febuary 2001
Author Contact acid_cool_178@hotmail.com
Dedication Goes to DaFixer for DeDe
Difficulty Level (1..7) 1 (EASY)
Tools Required Language
UPX
DeDe (I'm are using version 2.44)
Download it from http://www.protools.cjb.net 

 

Introduction
 

Well, I'm are on lack at DeDe reversing information and maybe time and spirit to work... Since I'm are bussy in the real life atm. so are it ahrd for me to work as I used to do when I was only a member in Hellfroge for a year ago.. 
 

Tutorial
 

First so have we to now what we shall lok at when we are beginning to work on this crackme. 
Open Crackme1.exe and click at the "Register" button and you will get one message that you have to enter your name and the same if you are leaving the serial fiels open.. I Tried Acid_Cool_178 as my name and 2951 as the serial and I got the message "Too bad" well, thanx for the message StealthFighter :)

Noe, try language ans see what it's coded in and you will see that thic crackme is packed in upx nad you won't get any info in the language what it's written in. Unpack it by using ProcDump or UPX, I don't care...Try langauage now again and you will see that it's written in Delphi and that makes me very happy coz now we can use DeDe and it's one easy and userfriendly tool for crackers to use.. 

We will follow our standard Delphi progress

  1. Open DeDe
  2. Open File and select CracMe1.exe
  3. Click on the Process Button and now DeDe are disassembeling the crackme
  4. Follow the instruction under the Disassembeling
  5. Goto the procedures tab in DeDe
  6. Select TForm1 and Button1Click  and dubbleclick at Button1Click

And now you will see this code in a new window.

 |
0042E1DC   E867FEFFFF             call    0042E048
0042E1E1   C3                     ret

Now, this is nothing to be afraid off, just dubbleclick at the call at 0042E1DC and you will now see this code...  And I have taken out the important code for you..

***** TRY
|
0042E05C   64FF30                 push    dword ptr fs:[eax]
0042E05F   648920                 mov     fs:[eax], esp
0042E062   8D55F4                 lea     edx, [ebp-$0C]

* Reference to control Edit1 : N.A. <-- Setting the focus at the Edit1 field and that's out Name
|
0042E065   8B83DC010000           mov     eax, [ebx+$01DC]    

* Reference to: Controls.TControl.GetText@23EDC2EF    <-- Get's the name
|
0042E06B   E898BEFEFF             call    00419F08    <-- Executes the GetText function
0042E070   8B45F4                 mov     eax, [ebp-$0C]    <-- EAX == Name (Acid_Cool_178)

* Reference to: System.@LStrLen@C43AB84F    <-- Trims our serial, if name == A C then it will be AC and in my case it is Acid_Cool_178 :)
|
0042E073   E84857FDFF             call    004037C0    <-- Executes the LstrLen funation
0042E078   85C0                   test    eax, eax    <-- IF no name entred then jump to "Enter you name" message
0042E07A   7E78                   jle     0042E0F4    <-- Here it jumps to the "Enter you name" message
0042E07C   8D55F4                 lea     edx, [ebp-$0C]    <-- EDX == Name 

* Reference to control Edit2 : N.A.    <-- Sets focus on the Edit2 field and that are our serial field
|
0042E07F   8B83E0010000           mov     eax, [ebx+$01E0]

* Reference to: Controls.TControl.GetText@23EDC2EF    <-- Get's the text
|
0042E085   E87EBEFEFF             call    00419F08    <-- Executes the GetText funxtion
0042E08A   8B45F4                 mov     eax, [ebp-$0C]    <-- EAX == Serial

* Reference to: System.@LStrLen@C43AB84F    <-- Trims our Serial
|
0042E08D   E82E57FDFF             call    004037C0    <-- Executes the LStrLen funation
0042E092   85C0                   test    eax, eax    <-- If no serial entered then
0042E094   7E4C                   jle     0042E0E2    <-- jump to the "Enter you serial" message
0042E096   8D55FC                 lea     edx, [ebp-$04]  <-- EDX == Serial

* Reference to control Edit2 : N.A.    <-- Sets focus on the Edit2 field and that are our serial field
|
0042E099   8B83E0010000           mov     eax, [ebx+$01E0]

* Reference to: Controls.TControl.GetText@23EDC2EF    <-- Get's the text
|
0042E09F   E864BEFEFF             call    00419F08    <-- Executes the GetText funxtion
0042E0A4   8D45F8                 lea     eax, [ebp-$08]    <-- EAX == Serial

* Possible String Reference to: 'iamnotalooser'    <-- What's this 
|
0042E0A7   BA3CE14200             mov     edx, $0042E13C    <-- EDX == iamnotalooser

* Reference to: System.@LStrLAsg@51F89FF7    <-- Trims iamnotalooser
|
0042E0AC   E82B55FDFF             call    004035DC    <-- Executes the function
0042E0B1   8B45FC                 mov     eax, [ebp-$04]    <-- EAX == Entred serial
0042E0B4   8B55F8                 mov     edx, [ebp-$08]    <-- EDX == iamnotalooser

* Reference to: System.@LStrCmp@51F89FF7    <-- Compares the serials
|
0042E0B7   E81458FDFF             call    004038D0    <-- Here they are compares
0042E0BC   7512                   jnz     0042E0D0    <-- If not correct then jump to the bad message

* Possible String Reference to: 'Congratulations, you did it! Now ma    <-- yeah, the good message
|                                il me your solution!'
|
0042E0BE   BA54E14200             mov     edx, $0042E154    <-- EDX == Good message

* Reference to control Edit2 : N.A.    <-- Sets the focus ont he Edit2fiels wich are the Serial field
|
0042E0C3   8B83E0010000           mov     eax, [ebx+$01E0]    

* Reference to: Controls.TControl.SetText@23EDC2EF    <-- SetText are setting the good message to the edit2 field
|
0042E0C9   E86ABEFEFF             call    00419F38    <-- Execues the SetText function
0042E0CE   EB34                   jmp     0042E104    <-- jump to the end of this process

* Possible String Reference to: 'Too bad!'    <-- The bad message
|
0042E0D0   BA94E14200             mov     edx, $0042E194    

* Reference to control Edit2 : N.A.    <-- Set's the foctus on the Edit2 field wich are our serial field
|
0042E0D5   8B83E0010000           mov     eax, [ebx+$01E0]

* Reference to: Controls.TControl.SetText@23EDC2EF       <-- SetText are setting the bad message to the edit2 field
|
0042E0DB   E858BEFEFF             call    00419F38    <-- Executes the SetText function
0042E0E0   EB22                   jmp     0042E104    <-- jump to the end of this process

* Possible String Reference to: 'Enter serial!'    <-- The Enter your serial message if you haven't entred it
|
0042E0E2   BAA8E14200             mov     edx, $0042E1A8    <-- EDX == "enter serial!"

* Reference to control Edit2 : N.A.    <-- Set's the focus on Edit2 fiels wich are our serial field
|
0042E0E7   8B83E0010000           mov     eax, [ebx+$01E0]

* Reference to: Controls.TControl.SetText@23EDC2EF    <-- SetText are setting the "Enter serial!" message to the editfield
|
0042E0ED   E846BEFEFF             call    00419F38    <-- Executes the SetText function
0042E0F2   EB10                   jmp     0042E104    <-- jump to the end of this process

* Possible String Reference to: 'Enter your name!'    <-- The "Enter your name!" message if you hadn't
|
0042E0F4   BAC0E14200             mov     edx, $0042E1C0    <-- EDX == Enter you name!

* Reference to control Edit1 : N.A.    <-- Set's the focus on the Edit1 fiels wich are out Name field
|
0042E0F9   8B83DC010000           mov     eax, [ebx+$01DC]

* Reference to: Controls.TControl.SetText@23EDC2EF    <-- SetText are setting "Enter your name!" to the Name field
|
0042E0FF   E834BEFEFF             call    00419F38    <-- Executes the SetText function
0042E104   33C0                   xor     eax, eax    <-- EAX == 0
0042E106   5A                     pop     edx    
0042E107   59                     pop     ecx    
0042E108   59                     pop     ecx    
0042E109   648910                 mov     fs:[eax], edx

****** FINALLY    <-- The end :)

And here it is.. But the Call at location 42E0B7 tyhat i have marked RED is important, because the CMP EDX,EAX is int here, to trace into that call by dubbleclicking at it and you will see this code, I have only taken out one little snip of it. 

004038D3   89C6                   mov     esi, eax    <-- ESI == our serial
004038D5   89D7                   mov     edi, edx    <-- ESI == iamnotalooser
004038D7   39D0                   cmp     eax, edx    <-- The comapre routine

And here it is, EAX == our entred serial and EDX == iamnotalooser
2951 and iamnotalooser if not equal so i changed 2951 to iamnotalooser and it worked, but I didn't find Name things algo in here to iamnotalooser workd on every name that you ever want to use if you haven patched this crackme to don't work :)

 

Final Thoughts
 

Thank god that Falcon have found time to get back in Hellforge and now he got some plans on a mass kick so I guess that this are my last tut for Hellforge and I'm are wodnering on who have to leave the group... 

stealthfighter haven't coded one lame crackme, no damm way, this crackme is hard to crack for newbies without the right tools and I had them... I had Language, UPX and DeDe and the crackme have some fancy functions that are checking the serial and name lenght, if it are 0 then it wont be cracked, only patched and I'm aren't patching this crackme.... But trying to understand it... 


 
Greetings to...



Special Greetings: 
stealthfighter for making one strange crackme and I have learned soemthing new in this crackme too 
czDrillard 4 making he's crackme 2 that was the first one i understood 150% perfect
LaZARuS for he's great tutorials....
+DaFixer for DeDe
The Cracking Answer for not even bugging me for writting or cracking anything, that group roxx!!!! You will get alotta work from me now soon :D

Groups:  HF, ID, TCA, GC, TMG

Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper, CD_Knight and all the rest that i have forgotten

 

The end.
Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.