Author | Acid_Cool_178
Target | 2Sweet Crackme 2.C
Download it from | http://2Sweet.tsx.orx
Public Release | 20 March 2001
Author Contact | acid_cool_178@hotmail.com
Dedication | Goes to 2Sweet and +DaFixer for DeDe
Difficulty Level (1..7) | 3 ( Easy-Medium)
Tools Required | DeDe (I'm are using version 2.50)
Download it from | http://www.protools.cjb.net

Introduction

Back in the keygenning skills and I made it again.... I founded back my DeDe tool and worked out some new things, I'm still working on another crackme, and it's more fun ;) alotta work on me.... hehehehehe, I love it to the maxxxx....

Tutorial

This crackme have one name and serial, we will keygen this crackme so we have to understand the algorithm on this app, that's why +DaFixer have made DeDe, it's so easy to use that MS can cry...

- Open DeDe
- Open File and select DCM2C.EXE
- Click on the Process Button and now DeDe are disassembling the crackme
- Follow the instruction under the Disassembling
- Goto the procedures tab in DeDe
- Select TForm1 and Button1Click and double-click at Button1Click

And now you will see this, and here is also the debugging code for us :) The Serial algorithm is in here....

00442205 64FF30 push dword ptr fs:[eax]
00442208 648920 mov fs:[eax], esp
0044220B 8D55FC lea edx, [ebp-$04]

* Reference to control TForm1.Edit1 : TEdit <-- Gets the Name
|
0044220E 8B86D0020000 mov eax, [esi+$02D0] <--EAX == Name

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets the name
|
00442214 E8CB0FFEFF call 004231E4 <-- Executes the function
00442219 8B45FC mov eax, [ebp-$04] <-- EAX == Name

* Reference to: system.@LStrToPChar;
|
0044221C E8D719FCFF call 00403BF8

* Reference to: sysutils.StrLen(System.PChar):System.Cardinal;<-- Gets length of name
|
00442221 E89E56FCFF call 004078C4 <-- executes the function
00442226 8BC8 mov ecx, eax <-- ECX == Length of name
00442228 BB01000000 mov ebx, $00000001 <-- EBX == Counter 1
0044222D B801000000 mov eax, $00000001 <-- EAX == Counter 2
00442232 3BC1 cmp eax, ecx <-- Compare Length of name with ECX
00442234 7F0F jnle 00442245<-- Jump if EAX == less than Counter 2
00442236 8B55FC mov edx, [ebp-$04] <-- EDX == Name
00442239 0FB65402FF movzx edx, byte ptr [edx+eax-$01] <-- Takes one char of the name
0044223E 40 inc eax <-- Increases EAX
0044223F 03DA add ebx, edx <-- EBX == EBX+EDX
00442241 3BC1 cmp eax, ecx <-- IF all chars are done then
00442243 7EF1 jle 00442236<-- skip this jump
00442245 8BC3 mov eax, ebx <-- EAX == the result if the calculation
00442247 C1E004 shl eax, $04 <-- SHL EAX,4
0044224A 03C3 add eax, ebx <-- EAX == EAX + EBX
0044224C 8BD8 mov ebx, eax <-- EBX == EAX
0044224E 8D55F8 lea edx, [ebp-$08]
00442251 8BC3 mov eax, ebx

* Reference to: sysutils.IntToStr(System.Integer):System.AnsiString;overload; <-- Convert the HEX to ASCII Decimal
|
00442253 E8E053FCFF call 00407638 <-- Executes the function
00442258 8B45F8 mov eax, [ebp-$08] <-- EAX == Result of the conversion
0044225B 50 push eax
0044225C 8D55F4 lea edx, [ebp-$0C]

* Reference to control TForm1.Edit2 : TEdit <-- Focus on the serial field
|
0044225F 8B86D4020000 mov eax, [esi+$02D4]

* Reference to: controls.TControl.GetText(TControl):System.String;<-- Gets the serial
|
00442265 E87A0FFEFF call 004231E4 <-- Executes the function
0044226A 8B55F4 mov edx, [ebp-$0C] <-- EDX == serial
0044226D 58 pop eax

* Reference to: system.@LStrCmp; <-- Compare the serials
|
0044226E E8D118FCFF call 00403B44 <-- Executes the function
00442273 750C jnz 00442281 <-- jump if the serial was wrong

* Possible String Reference to: 'WELL DONE !' <-- The good message
|
00442275 B8C4224400 mov eax, $004422C4 <-- EAX == the good message

* Reference to: dialogs.ShowMessage(System.AnsiString); <-- Shows the good message
|
0044227A E845F9FFFF call 00441BC4<-- Executes the function
0044227F EB0A jmp 0044228B <-- Jump to the end of the routine

* Possible String Reference to: 'INCORRECT PASSNUMBER'<-- Bad message
|
00442281 B8D8224400 mov eax, $004422D8 <-- EAX == Bad message

* Reference to: dialogs.ShowMessage(System.AnsiString); <-- Shows the bad message
|
00442286 E839F9FFFF call 00441BC4 <-- Executes the function
0044228B 33C0 xor eax, eax <-- EAX == 0
0044228D 5A pop edx
0044228E 59 pop ecx
0044228F 59 pop ecx
00442290 648910 mov fs:[eax], edx

Lets take one small example in here
Name == AcidCool

Now the length of the name is 8 so it will be 8 loops for us to take
Loop1
A == 41
41 + 1 == 42
Loop2
c == 63
42 + 63 == A5

Loop3
i == 69
A5 + 69 == 10E

Loop4
d == 64
10E + 64 == 172

Loop5
C == 43
172 + 43 == 1B5

Loop6
o == 6F
1B5 + 6F == 224

Loop7
o == 6F
224+6F == 293

Loop8
l == 6C
293 + 6F == 2FF

After Loop8 so is 2FF the result from every char on the name plus ONE.

Take the result and so one SHR,4 and then my result was 2FF0

Now we got two values, 2FF and 2FF0, they is added together'

2FF + 2FF0 == 32EF

32EF to decimal and you have your serial... Mine was 13039 and it worked for the name :)

Final Thoughts

I got the idea at one example from NeO'X'QuiCk and that really roxx dyed. I have your tutorials man, keep up the good and fantastic work !!

Greetings to...

Special Greetings:
LaZARuS for he's great tutorials....
+DaFixer for DeDe
The Cracking Answer for not even bugging me for writing or cracking anything, that group roxx!!!! You will get alotta work from me now soon :D
NeO'X'QuiCk for your spirit and ideas on working.

Groups: HF, ID, TCA, GC, TMG
Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper, CD_Knight and all the rest that i have forgotten

The end.

Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.