Author | Acid_Cool_178
Target | 2Sweet Crackme 2.0
Download it from | http://2Sweet.tsx.orx
Public Release | 14 Febuary 2001
Author Contact | acid_cool_178@hotmail.com
Dedication | Goes to 2Sweet and DaFixer for DeDe
Difficulty Level (1..7) | 3 (Easy/Med)
Tools Required | DeDe (I'm are using version 2.44)
Download it from | http://www.protools.cjb.net

Introduction

> Wellwell, I'm are falling into love now... Cracking are getting more fun when you now how to keygen things and my skills are growing realy fast right now, I can't evern understand how fun it is right now... But I'm are only cracking for one purpose, to learn and to protect my programs better when I will get myselfh a job ad one coder in the enar future... That's all and I wan't to provide my information with the rest of the world.

> Again, we will crack on 2Sweet's crackmes, I founded them intressing so i will work on them for a while and keygen them all (I hope) the crackme are included into this zip file....

Tutorial

> Well, time to get to now the crackme again. Run the crackme and you will now fnd 2 edit fields, the one are the UserName and the other are the serial... I will use 666 as my UserName and 2951 as my Serial. I tested it but I got the message "SERIAL NUMBER IS INCORRECT" and it realy are.... and 666 in decimal are 29A in HEX

> We will follow our standard Delphi progress

> We will follow the same stepas as we did with Crackme 1.0

> 1. Open DeDe
> 2. Open File and select dcm20.exe
> 3. Click on the Process Button and now DeDe are disassembeling the crackme
> 4. Follow the instruction under the Disassembeling
> 5. Goto the procedures tab in DeDe
> 6. Select TForm1 and Button1Click

> Step number 6 are only a great guess but i was sure that this was the right place when i founded the bad message when I scrolled down.

> Now, here is all the important code that you ever will need to now about this crackme

> * Reference to: Controls.TControl.GetText() <-- Gets some text
> |
> 00442A13 E89C08FEFF call 004232B4 <-- Gets the username (29A)
> 00442A18 8B45FC mov eax, [ebp-$04] <-- EAX == Username (EAX == 29A)

> * Reference to: Sysutils.StrToInt(System.AnsiString)
> |
> 00442A1B E8504CFCFF call 00407670
> 00442A20 8BF0 mov esi, eax <-- ESI == Usernumber
> 00442A22 8D55FC lea edx, [ebp-$04]

> * Reference to control TForm1.Edit2 : TEdit
> |
> 00442A25 8B83D4020000 mov eax, [ebx+$02D4]

> * Reference to: Controls.TControl.GetText() <-- Get's some text
> |
> 00442A2B E88408FEFF call 004232B4 <-- Gets the Serial
> 00442A30 8B45FC mov eax, [ebp-$04] <-- EAX == Serial

> * Reference to: Sysutils.StrToInt(System.AnsiString)
> |
> 00442A33 E8384CFCFF call 00407670
> 00442A38 8BD0 mov edx, eax <-- EDX == Serial
> 00442A3A 81C641010000 add esi, $00000141 <-- Usernumber + 141 (29A + 141 = 3DB)

> * Reference to field TEdit.OFFS_00D5
> |
> 00442A40 8D86D5000000 lea eax, [esi+$00D5] <-- EAX == EDX + D5 (3DB + D5 = 4B0)
> 00442A46 8D0440 lea eax, [eax+eax*2] <-- EAX == EAX * 2 (4B0 + 4B0 * 2 = E10)
> 00442A49 2D89000000 sub eax, $00000089 <-- EAX == EAX - 89 (E10 - 89 = D87)
> 00442A4E 3BC2 cmp eax, edx <-- Compare the Entres serial with the correct serial
> 00442A50 750C jnz 00442A5E <-- If not corect serial then jump to the bad message

> * Possible String Reference to: 'CRACKED !!!' <-- YESS :D
> |
> 00442A52 B8C02A4400 mov eax, $00442AC0 <-- EAX == Good message

> * Reference to: Dialogs.ShowMessage(System.AnsiString)
> |
> 00442A57 E838F2FFFF call 00441C94 <-- Shows the good message
> 00442A5C EB0A jmp 00442A68 <-- Jump to the program

> * Possible String Reference to: 'SERIAL NUMBER INCORRECT' <-- Bad Message
> |
> 00442A5E B8D42A4400 mov eax, $00442AD4 <-- EAX == Bad Message

> Well, again I have managed to keygen one Delphi crackme.. I just love this shit..
> Here are my Ollydbg notes of you would like to see them, I used OllyDbg first but I have grown in skills to keygen at this crackme too....

>     00442A13   . E8 9C08FEFF    CALL    dcm20.004232B4                   ;  Get's out UserNumber
>     00442A18   . 8B45 FC        MOV     EAX,DWORD PTR SS:[EBP-4]         ;  EAX == UserNumber
>     00442A1B   . E8 504CFCFF    CALL    dcm20.00407670
>     00442A20   . 8BF0           MOV     ESI,EAX                          ;  ESI == UserNumber
>     00442A22   . 8D55 FC        LEA     EDX,DWORD PTR SS:[EBP-4]
>     00442A25   . 8B83 D4020000  MOV     EAX,DWORD PTR DS:[EBX+2D4]
>     00442A2B   . E8 8408FEFF    CALL    dcm20.004232B4                   ;  Gets the serial
>     00442A30   . 8B45 FC        MOV     EAX,DWORD PTR SS:[EBP-4]         ;  EAX == Serial
>     00442A33   . E8 384CFCFF    CALL    dcm20.00407670
>     00442A38   . 8BD0           MOV     EDX,EAX                          ;  EDX == Serial
>     00442A3A   . 81C6 41010000  ADD     ESI,141                          ;  UserNumber + 141
>     00442A40   . 8D86 D5000000  LEA     EAX,DWORD PTR DS:[ESI+D5]        ;  EAX == ESI + D5
>     00442A46   . 8D0440         LEA     EAX,DWORD PTR DS:[EAX+EAX*2]     ;  EAX == EAX+EAX * 2
>     00442A49   . 2D 89000000    SUB     EAX,89                           ;  EAX == EAX - 89
>     00442A4E   . 3BC2           CMP     EAX,EDX

> And that was all from me and this crackme notes... It are totally reversed but i have some problems with my win32ASM keygen and I havent tried in Visual Basic yet.. Will do it now.

> EYY

> I'm are a master....

> HEre is the VB6 source

>     Private Sub Command1_Click()
>     Dim user
>     Dim serial
>     usernumber = Text1.Text
>     serial = usernumber + 321 + 213
>     serial = serial + serial * 2
>     serial = serial - 137
>     Label1.Caption = serial
>     End Sub

> And you can also find the keygen in the zip file...

Final Thoughts

> I'm are not proud over my win32asm skills, i thought that they were better but i had proglems to make one keygen for this program... I'm are a lamer in other words..... Now, I will strp down and take a break and think what the hell were wrong.. This was one kick in the face for me and I won't release this tut for any groups before the keygen in Win32ASM are finished...

> Acid_Cool_178 is logging out and leaving to he's girlfriend now.... Cya

Greetings to...

Special Greetings:
czDrillard 4 making he's crackme 2 that was the first one i understood 150% perfect
LaZARuS for he's great tutorials....
+DaFixer for DeDe

Groups: HF, ID, TCA, GC
Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper, CD_Knight and all the rest that i have forgotten

The end.

Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.