Author | Acid_Cool_178
Target | StealthFighter Crackme 2.0
Download it from | http://stealthfighter.cjb.net
Public Release | 20 March 2001
Author Contact | acid_cool_178@hotmail.com
Dedication | +DaFixer for DeDe
Difficulty Level (1..7) | 4 (Medium)
Tools Required | Language UPX DeDe (I'm are using version 2.50) OllyDbg (Not needed)
Download it from | http://www.protools.cjb.net

Introduction

StealthFighter had one strange crackme, he's first crackme.. Name and serial, serial was only "iamnotalooser" and that serial worked for every name that you entered.. Se my tut 17 for more info on that one. And on this crackme so is the protection really hard thought trough.

Tutorial

This crackme have one Name and serial, this serial is generated from the name.

I used AcidCool as the name

Run language and you will see that it's packed with UPX, unpack it and open it in DeDe

On Button2Click will you see this.

00432120 53 push ebx
00432121 8BD8 mov ebx, eax
00432123 8BC3 mov eax, ebx

|
00432125 E8AEFCFFFF call 00431DD8 <-- FIRST CALL
0043212A 8BC3 mov eax, ebx

|
0043212C E8E3FDFFFF call 00431F14 <-- SECOND CALL
00432131 8BC3 mov eax, ebx

|
00432133 E814FFFFFF call 0043204C <-- THIRD CALL
00432138 5B pop ebx
00432139 C3 ret

;=============================================================================
; FIRST CALL
;=============================================================================
This call is getting the Name and checking it it it's over 4 chars and etc.
IF no name entered then show a bad message and if not then continue to SECOND CALL

;=============================================================================
; SECOND CALL
;=============================================================================

00431F2D 64FF30 push dword ptr fs:[eax]
00431F30 648920 mov fs:[eax], esp
00431F33 8D55F0 lea edx, [ebp-$10]
00431F36 8B87DC010000 mov eax, [edi+$01DC]

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets the Name
|
00431F3C E8D380FEFF call 0041A014<-- executes the function
00431F41 8B45F0 mov eax, [ebp-$10]<-- EAX == Length of name
00431F44 8D55F4 lea edx, [ebp-$0C] <-- EDX == Name

* Reference to: sysutils.LowerCase(S: <-- convert Name to lowercase
|
00431F47 E8CC44FDFF call 00406418 <-- Executes the function
00431F4C 8B45F4 mov eax, [ebp-$0C] <-- EAX == Name in lowercase

|
00431F4F E86C18FDFF call 004037C0
00431F54 8BD8 mov ebx, eax <-- EBX == Length of name

Start of LOOP 1

00431F56 85DB test ebx, ebx <-- Jump when EBX == 0
00431F58 7E14 jle 00431F6E <-- Jump out of the loop
00431F5A BE01000000 mov esi, $00000001 <-- ESI == Counter
00431F5F 8B45F4 mov eax, [ebp-$0C] <-- EAX == Name in lowercase
00431F62 0FB64430FF movzx eax, byte ptr [eax+esi-$01] <-- takes one char from the name
00431F67 0145FC add [ebp-$04], eax <-- Adding the chars
00431F6A 46 inc esi<-- increase ESI
00431F6B 4B dec ebx <-- decrease EBX
00431F6C 75F1 jnz 00431F5F <-- LOOP

Loop 1 END

EAX == Name
ESI == Counter 1, counting up to the length of the name
EBX == Counter 2, counting down to zero
EBP-$04 == Pointer to the Name chard added together, a+b+c+d....n

00431F6E 8D55F0 lea edx, [ebp-$10]
00431F71 8B8700020000 mov eax, [edi+$0200]

* Reference to: controls.TControl.GetText(TControl):System.String;<-- Gets the text "CrackThePlanet"
|
00431F77 E89880FEFF call 0041A014 <-- Executes the function
00431F7C 8B45F0 mov eax, [ebp-$10] <-- EAX == "CrackThePlanet"

|
00431F7F E83C18FDFF call 004037C0 <-- Gets the length of "CrackThePlanet"
00431F84 8BD8 mov ebx, eax <-- EBX == Length of "CrackThePlanet" == E
00431F86 85DB test ebx, ebx<-- Checks if EBX == 0
00431F88 7E22 jle 00431FAC <-- IF EBX == 0 then jump
00431F8A BE01000000 mov esi, $00000001 <-- ESI == Up counter

Start of LOOP 2

00431F8F 8D55F0 lea edx, [ebp-$10]<-- EDX== "CrackThePlanet"
00431F92 8B8700020000 mov eax, [edi+$0200]

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets "CrackThePlanet"
|
00431F98 E87780FEFF call 0041A014 <-- executes the function
00431F9D 8B45F0 mov eax, [ebp-$10] <-- EAX == "CrackThePlanet"
00431FA0 0FB64430FF movzx eax, byte ptr [eax+esi-$01]<-- Takes one char of "CrackThePlanet"
00431FA5 0145F8 add [ebp-$08], eax <-- Adding the chars
00431FA8 46 inc esi <-- Increasing ESI
00431FA9 4B dec ebx <-- Decreasing EBX
00431FAA 75E3 jnz 00431F8F <-- Jump to start of loop 2

End of Loop 2

EAX == CrackThePlanet
ESI == Upconter
EBX == Downconter
EBP-$08 == The result of C+r+a+c+k+T+h+e+P+l+a+n+e+t in HEX wich is 569

00431FAC 8D55F0 lea edx, [ebp-$10] <-- EDX == "CrackThePlanet"
00431FAF 8B87DC010000 mov eax, [edi+$01DC]

* Reference to: controls.TControl.GetText(TControl):System.String;<-- Gets the Name
|
00431FB5 E85A80FEFF call 0041A014 <-- Executes the function
00431FBA 8B45F0 mov eax, [ebp-$10]<-- EAX == Name in ASCII
|
00431FBD E8FE17FDFF call 004037C0 <-- Gets the length of name
00431FC2 F76DF8 imul dword ptr [ebp-$08] <-- Multiply Length of name with 569
00431FC5 8945F8 mov [ebp-$08], eax <-- Store the result at EBP-$8
00431FC8 8D55E8 lea edx, [ebp-$18]
00431FCB 8B45FC mov eax, [ebp-$04] <-- EDX == the sum of name (hex)

* Reference to: sysutils.IntToStr(Value: <-- Convert sum of name to ASCII (also converting to DECIMAL)
|
00431FCE E8AD46FDFF call 00406680 <-- executes the function,
00431FD3 FF75E8 push dword ptr [ebp-$18] <-- EBP-$18 == The ASCII Value of out name
00431FD6 6848204300 push $00432048
00431FDB 8D55E4 lea edx, [ebp-$1C]

* Reference to Form1
|
00431FDE 8B45F8 mov eax, [ebp-$08]<-- EAX == 2B48

* Reference to: sysutils.IntToStr(Value: <-- Convert 2B48 to DECIMAL and to ASCII wich is 11080
|
00431FE1 E89A46FDFF call 00406680 <-- Executes the function
00431FE6 FF75E4 push dword ptr [ebp-$1C] <-- EBP-$1C == The result
00431FE9 8D45EC lea eax, [ebp-$14]
00431FEC BA03000000 mov edx, $00000003 <-- EDX == 3

|
00431FF1 E88A18FDFF call 00403880 <-- Makes the string, "SUM OF NAME-11080"
00431FF6 8B55EC mov edx, [ebp-$14]
00431FF9 8B8704020000 mov eax, [edi+$0204]

* Reference to: controls.TControl.SetText(TControl;System.String);
|
00431FFF E84080FEFF call 0041A044
00432004 33C0 xor eax, eax
00432006 5A pop edx
00432007 59 pop ecx
00432008 59 pop ecx
00432009 648910 mov fs:[eax], edx

;=============================================================================
; THIRD CALL
;=============================================================================

In here is our Serial compared and it it's correct then the good message will appear
else the bad message will appear...

here is what worked for me

Name:AcidCool
serial:830-11080

    Now, lets try one small example

    I used the name AcidCool wich have the length 8 and will be acidcool on lower case.

    a == 61h
    c == 63h
    i == 69h
    d == 64h
    c == 63h
    o == 6Fh
    o == 6Fh
    l == 6Ch

    Loop1 == 61h
    Loop2 == 61h + 63h ==  C4h
    Loop3 == C4h + 69h == 12Dh
    Loop4 == 12Dh + 64h == 191h
    Loop5 ==191h + 63h == 1F4h
    Loop6 == 1F4h + 6Fh == 263h
    Loop7 == 263h + 6Fh == 2D2h
    Loop8 ==2D2h + 6Ch == 33Eh

    Sum of "CrackThePlanet" == 569h

    569h * 8h == 2B48h == 11080 in Decimal
    33Eh == 830 in decimal

    Serial == 830-11080

Final Thoughts

Well well, another Crackme keygenned with help of DeDe.. One brilliant tool for everyone that want to learn to keygen Delphi applications

Greetings to...

Special Greetings:
LaZARuS for he's great tutorials....
+DaFixer for DeDe
The Cracking Answer for not even bugging me for writing or cracking anything, that group roxx!!!! You will get alotta work from me now soon :D
StealthFighter for good crackmes

Groups: HF, ID, TCA, GC, TMG
Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Stealhfighter, Eddie Van Camper, CD_Knight and all the rest that i have forgotten

The end.

Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.