Author | Acid_Cool_178
Target | StealthFighter's Crackme No.1
Download it from | http://www.setalthfighter.cjb.net
Public Release | 18 Febuary 2001
Author Contact | acid_cool_178@hotmail.com
Dedication | Goes to DaFixer for DeDe
Difficulty Level (1..7) | 1 (EASY)
Tools Required | Language UPX DeDe (I'm are using version 2.44)
Download it from | http://www.protools.cjb.net

Introduction

> Well, I'm are on lack at DeDe reversing information and maybe time and spirit to work... Since I'm are bussy in the real life atm. so are it ahrd for me to work as I used to do when I was only a member in Hellfroge for a year ago..

Tutorial

> First so have we to now what we shall lok at when we are beginning to work on this crackme.
> Open Crackme1.exe and click at the "Register" button and you will get one message that you have to enter your name and the same if you are leaving the serial fiels open.. I Tried Acid_Cool_178 as my name and 2951 as the serial and I got the message "Too bad" well, thanx for the message StealthFighter :)

> Noe, try language ans see what it's coded in and you will see that thic crackme is packed in upx nad you won't get any info in the language what it's written in. Unpack it by using ProcDump or UPX, I don't care...Try langauage now again and you will see that it's written in Delphi and that makes me very happy coz now we can use DeDe and it's one easy and userfriendly tool for crackers to use..

> We will follow our standard Delphi progress

> 1. Open DeDe
> 2. Open File and select CracMe1.exe
> 3. Click on the Process Button and now DeDe are disassembeling the crackme
> 4. Follow the instruction under the Disassembeling
> 5. Goto the procedures tab in DeDe
> 6. Select TForm1 and Button1Click and dubbleclick at Button1Click

> And now you will see this code in a new window.

> |
> 0042E1DC E867FEFFFF call 0042E048
> 0042E1E1 C3 ret

> Now, this is nothing to be afraid off, just dubbleclick at the call at 0042E1DC and you will now see this code... And I have taken out the important code for you..

> ***** TRY
> |
> 0042E05C 64FF30 push dword ptr fs:[eax]
> 0042E05F 648920 mov fs:[eax], esp
> 0042E062 8D55F4 lea edx, [ebp-$0C]

> * Reference to control Edit1 : N.A. <-- Setting the focus at the Edit1 field and that's out Name
> |
> 0042E065 8B83DC010000 mov eax, [ebx+$01DC]

> * Reference to: Controls.TControl.GetText@23EDC2EF <-- Get's the name
> |
> 0042E06B E898BEFEFF call 00419F08 <-- Executes the GetText function
> 0042E070 8B45F4 mov eax, [ebp-$0C] <-- EAX == Name (Acid_Cool_178)

> * Reference to: System.@LStrLen@C43AB84F <-- Trims our serial, if name == A C then it will be AC and in my case it is Acid_Cool_178 :)
> |
> 0042E073 E84857FDFF call 004037C0 <-- Executes the LstrLen funation
> 0042E078 85C0 test eax, eax <-- IF no name entred then jump to "Enter you name" message
> 0042E07A 7E78 jle 0042E0F4 <-- Here it jumps to the "Enter you name" message
> 0042E07C 8D55F4 lea edx, [ebp-$0C] <-- EDX == Name

> * Reference to control Edit2 : N.A. <-- Sets focus on the Edit2 field and that are our serial field
> |
> 0042E07F 8B83E0010000 mov eax, [ebx+$01E0]

> * Reference to: Controls.TControl.GetText@23EDC2EF <-- Get's the text
> |
> 0042E085 E87EBEFEFF call 00419F08 <-- Executes the GetText funxtion
> 0042E08A 8B45F4 mov eax, [ebp-$0C] <-- EAX == Serial

> * Reference to: System.@LStrLen@C43AB84F <-- Trims our Serial
> |
> 0042E08D E82E57FDFF call 004037C0 <-- Executes the LStrLen funation
> 0042E092 85C0 test eax, eax <-- If no serial entered then
> 0042E094 7E4C jle 0042E0E2 <-- jump to the "Enter you serial" message
> 0042E096 8D55FC lea edx, [ebp-$04] <-- EDX == Serial

> * Reference to control Edit2 : N.A. <-- Sets focus on the Edit2 field and that are our serial field
> |
> 0042E099 8B83E0010000 mov eax, [ebx+$01E0]

> * Reference to: Controls.TControl.GetText@23EDC2EF <-- Get's the text
> |
> 0042E09F E864BEFEFF call 00419F08 <-- Executes the GetText funxtion
> 0042E0A4 8D45F8 lea eax, [ebp-$08] <-- EAX == Serial

> * Possible String Reference to: 'iamnotalooser' <-- What's this
> |
> 0042E0A7 BA3CE14200 mov edx, $0042E13C <-- EDX == iamnotalooser

> * Reference to: System.@LStrLAsg@51F89FF7 <-- Trims iamnotalooser
> |
> 0042E0AC E82B55FDFF call 004035DC <-- Executes the function
> 0042E0B1 8B45FC mov eax, [ebp-$04] <-- EAX == Entred serial
> 0042E0B4 8B55F8 mov edx, [ebp-$08] <-- EDX == iamnotalooser

> * Reference to: System.@LStrCmp@51F89FF7 <-- Compares the serials
> |
> 0042E0B7 E81458FDFF call 004038D0 <-- Here they are compares
> 0042E0BC 7512 jnz 0042E0D0 <-- If not correct then jump to the bad message

> * Possible String Reference to: 'Congratulations, you did it! Now ma <-- yeah, the good message
> | il me your solution!'
> |
> 0042E0BE BA54E14200 mov edx, $0042E154 <-- EDX == Good message

> * Reference to control Edit2 : N.A. <-- Sets the focus ont he Edit2fiels wich are the Serial field
> |
> 0042E0C3 8B83E0010000 mov eax, [ebx+$01E0]

> * Reference to: Controls.TControl.SetText@23EDC2EF <-- SetText are setting the good message to the edit2 field
> |
> 0042E0C9 E86ABEFEFF call 00419F38 <-- Execues the SetText function
> 0042E0CE EB34 jmp 0042E104 <-- jump to the end of this process

> * Possible String Reference to: 'Too bad!' <-- The bad message
> |
> 0042E0D0 BA94E14200 mov edx, $0042E194

> * Reference to control Edit2 : N.A. <-- Set's the foctus on the Edit2 field wich are our serial field
> |
> 0042E0D5 8B83E0010000 mov eax, [ebx+$01E0]

> * Reference to: Controls.TControl.SetText@23EDC2EF <-- SetText are setting the bad message to the edit2 field
> |
> 0042E0DB E858BEFEFF call 00419F38 <-- Executes the SetText function
> 0042E0E0 EB22 jmp 0042E104 <-- jump to the end of this process

> * Possible String Reference to: 'Enter serial!' <-- The Enter your serial message if you haven't entred it
> |
> 0042E0E2 BAA8E14200 mov edx, $0042E1A8 <-- EDX == "enter serial!"

> * Reference to control Edit2 : N.A. <-- Set's the focus on Edit2 fiels wich are our serial field
> |
> 0042E0E7 8B83E0010000 mov eax, [ebx+$01E0]

> * Reference to: Controls.TControl.SetText@23EDC2EF <-- SetText are setting the "Enter serial!" message to the editfield
> |
> 0042E0ED E846BEFEFF call 00419F38 <-- Executes the SetText function
> 0042E0F2 EB10 jmp 0042E104 <-- jump to the end of this process

> * Possible String Reference to: 'Enter your name!' <-- The "Enter your name!" message if you hadn't
> |
> 0042E0F4 BAC0E14200 mov edx, $0042E1C0 <-- EDX == Enter you name!

> * Reference to control Edit1 : N.A. <-- Set's the focus on the Edit1 fiels wich are out Name field
> |
> 0042E0F9 8B83DC010000 mov eax, [ebx+$01DC]

> * Reference to: Controls.TControl.SetText@23EDC2EF <-- SetText are setting "Enter your name!" to the Name field
> |
> 0042E0FF E834BEFEFF call 00419F38 <-- Executes the SetText function
> 0042E104 33C0 xor eax, eax <-- EAX == 0
> 0042E106 5A pop edx
> 0042E107 59 pop ecx
> 0042E108 59 pop ecx
> 0042E109 648910 mov fs:[eax], edx

> ****** FINALLY <-- The end :)

> And here it is.. But the Call at location 42E0B7 tyhat i have marked RED is important, because the CMP EDX,EAX is int here, to trace into that call by dubbleclicking at it and you will see this code, I have only taken out one little snip of it.

> 004038D3 89C6 mov esi, eax <-- ESI == our serial
> 004038D5 89D7 mov edi, edx <-- ESI == iamnotalooser
> 004038D7 39D0 cmp eax, edx <-- The comapre routine

> And here it is, EAX == our entred serial and EDX == iamnotalooser
> 2951 and iamnotalooser if not equal so i changed 2951 to iamnotalooser and it worked, but I didn't find Name things algo in here to iamnotalooser workd on every name that you ever want to use if you haven patched this crackme to don't work :)

Final Thoughts

> Thank god that Falcon have found time to get back in Hellforge and now he got some plans on a mass kick so I guess that this are my last tut for Hellforge and I'm are wodnering on who have to leave the group...

> stealthfighter haven't coded one lame crackme, no damm way, this crackme is hard to crack for newbies without the right tools and I had them... I had Language, UPX and DeDe and the crackme have some fancy functions that are checking the serial and name lenght, if it are 0 then it wont be cracked, only patched and I'm aren't patching this crackme.... But trying to understand it...

Greetings to...

> Special Greetings:
> stealthfighter for making one strange crackme and I have learned soemthing new in this crackme too
> czDrillard 4 making he's crackme 2 that was the first one i understood 150% perfect
> LaZARuS for he's great tutorials....
> +DaFixer for DeDe
> The Cracking Answer for not even bugging me for writting or cracking anything, that group roxx!!!! You will get alotta work from me now soon :D

> Groups: HF, ID, TCA, GC, TMG
> Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper, CD_Knight and all the rest that i have forgotten

The end.

Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.