Author Acid_Cool_178
Target StealthFighter Crackme 2.0
Download it from http://stealthfighter.cjb.net
Public Release  20 March 2001
Author Contact acid_cool_178@hotmail.com
Dedication +DaFixer for DeDe
Difficulty Level (1..7) 4 (Medium)
Tools Required Language
UPX
DeDe (I'm are using version 2.50)
OllyDbg (Not needed)
Download it from http://www.protools.cjb.net 

 

Introduction
 

StealthFighter had one strange crackme, he's first crackme.. Name and serial, serial was only "iamnotalooser" and that serial worked for every name that you entered.. Se my tut 17 for more info on that one. And on this crackme so is the protection really hard thought trough.  
 

Tutorial
 

This crackme have one Name and serial, this serial is generated from the name. 

I used AcidCool as the name

Run language and you will see that it's packed with UPX, unpack it and open it in DeDe

On Button2Click will you see this.

00432120   53                     push    ebx
00432121   8BD8                   mov     ebx, eax
00432123   8BC3                   mov     eax, ebx

|
00432125   E8AEFCFFFF             call    00431DD8 <-- FIRST CALL
0043212A   8BC3                   mov     eax, ebx

|
0043212C   E8E3FDFFFF             call    00431F14 <-- SECOND CALL
00432131   8BC3                   mov     eax, ebx

|
00432133   E814FFFFFF             call    0043204C <-- THIRD CALL
00432138   5B                     pop     ebx
00432139   C3                     ret

;=============================================================================
;
FIRST CALL
;=============================================================================
This call is getting the Name and checking it it it's over 4 chars and etc.
IF no name entered then show a bad message and if not then continue to SECOND CALL

;=============================================================================
;
SECOND CALL
;=============================================================================

00431F2D   64FF30                 push    dword ptr fs:[eax]
00431F30   648920                 mov     fs:[eax], esp
00431F33   8D55F0                 lea     edx, [ebp-$10]
00431F36   8B87DC010000           mov     eax, [edi+$01DC]

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets the Name
|
00431F3C   E8D380FEFF             call    0041A014<-- executes the function
00431F41   8B45F0                 mov     eax, [ebp-$10]<-- EAX == Length of name
00431F44   8D55F4                 lea     edx, [ebp-$0C] <-- EDX == Name

* Reference to: sysutils.LowerCase(S: <-- convert Name to lowercase
|
00431F47   E8CC44FDFF             call    00406418 <-- Executes the function
00431F4C   8B45F4                 mov     eax, [ebp-$0C] <-- EAX == Name in lowercase

|
00431F4F   E86C18FDFF             call    004037C0
00431F54   8BD8                   mov     ebx, eax <-- EBX == Length of name

Start of LOOP 1

00431F56   85DB                   test    ebx, ebx <-- Jump when EBX == 0
00431F58   7E14                   jle     00431F6E <-- Jump out of the loop
00431F5A   BE01000000             mov     esi, $00000001 <-- ESI == Counter
00431F5F   8B45F4                 mov     eax, [ebp-$0C] <-- EAX == Name in lowercase
00431F62   0FB64430FF             movzx   eax, byte ptr [eax+esi-$01] <-- takes one char from the name
00431F67   0145FC                 add     [ebp-$04], eax <-- Adding the chars
00431F6A   46                     inc     esi<-- increase ESI
00431F6B   4B                     dec     ebx <-- decrease EBX
00431F6C   75F1                   jnz     00431F5F <-- LOOP

Loop 1 END

EAX == Name
ESI == Counter 1, counting up to the length of the name
EBX == Counter 2, counting down to zero
EBP-$04 == Pointer to the Name chard added together, a+b+c+d....n

00431F6E   8D55F0                 lea     edx, [ebp-$10]
00431F71   8B8700020000           mov     eax, [edi+$0200]

* Reference to: controls.TControl.GetText(TControl):System.String;<-- Gets the text "CrackThePlanet"
|
00431F77   E89880FEFF             call    0041A014 <-- Executes the function
00431F7C   8B45F0                 mov     eax, [ebp-$10] <-- EAX == "CrackThePlanet"

|
00431F7F   E83C18FDFF             call    004037C0 <-- Gets the length of "CrackThePlanet"
00431F84   8BD8                   mov     ebx, eax <-- EBX == Length of "CrackThePlanet" == E
00431F86   85DB                   test    ebx, ebx<-- Checks if EBX == 0
00431F88   7E22                   jle     00431FAC <-- IF EBX == 0 then jump
00431F8A   BE01000000             mov     esi, $00000001 <-- ESI == Up counter

Start of LOOP 2 

00431F8F   8D55F0                 lea     edx, [ebp-$10]<-- EDX== "CrackThePlanet"
00431F92   8B8700020000           mov     eax, [edi+$0200]

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets "CrackThePlanet"
|
00431F98   E87780FEFF             call    0041A014 <-- executes the function
00431F9D   8B45F0                 mov     eax, [ebp-$10] <-- EAX == "CrackThePlanet"
00431FA0   0FB64430FF             movzx   eax, byte ptr [eax+esi-$01]<-- Takes one char of "CrackThePlanet"
00431FA5   0145F8                 add     [ebp-$08], eax <-- Adding the chars 
00431FA8   46                     inc     esi <-- Increasing ESI
00431FA9   4B                     dec     ebx <-- Decreasing EBX
00431FAA   75E3                   jnz     00431F8F <-- Jump to start of loop 2

End of Loop 2

EAX == CrackThePlanet
ESI == Upconter 
EBX == Downconter
EBP-$08 == The result of C+r+a+c+k+T+h+e+P+l+a+n+e+t in HEX wich is 569

00431FAC   8D55F0                 lea     edx, [ebp-$10] <-- EDX == "CrackThePlanet"
00431FAF   8B87DC010000           mov     eax, [edi+$01DC]

* Reference to: controls.TControl.GetText(TControl):System.String;<-- Gets the Name
|
00431FB5   E85A80FEFF             call    0041A014 <-- Executes the function
00431FBA   8B45F0                 mov     eax, [ebp-$10]<-- EAX == Name in ASCII
|
00431FBD   E8FE17FDFF             call    004037C0 <-- Gets the length of name
00431FC2   F76DF8                 imul    dword ptr [ebp-$08] <-- Multiply Length of name with 569
00431FC5   8945F8                 mov     [ebp-$08], eax <-- Store the result at EBP-$8
00431FC8   8D55E8                 lea     edx, [ebp-$18]
00431FCB   8B45FC                 mov     eax, [ebp-$04] <-- EDX == the sum of name (hex)

* Reference to: sysutils.IntToStr(Value: <-- Convert sum of name to ASCII (also converting to DECIMAL)
|
00431FCE   E8AD46FDFF             call    00406680 <-- executes the function,
00431FD3   FF75E8                 push    dword ptr [ebp-$18] <-- EBP-$18 == The ASCII Value of out name
00431FD6   6848204300             push    $00432048
00431FDB   8D55E4                 lea     edx, [ebp-$1C]

* Reference to Form1
|
00431FDE   8B45F8                 mov     eax, [ebp-$08]<-- EAX == 2B48

* Reference to: sysutils.IntToStr(Value: <-- Convert 2B48 to DECIMAL and to ASCII wich is 11080
|
00431FE1   E89A46FDFF             call    00406680 <-- Executes the function
00431FE6   FF75E4                 push    dword ptr [ebp-$1C] <-- EBP-$1C == The result
00431FE9   8D45EC                 lea     eax, [ebp-$14]
00431FEC   BA03000000             mov     edx, $00000003 <-- EDX == 3

|
00431FF1   E88A18FDFF             call    00403880 <-- Makes the string, "SUM OF NAME-11080"
00431FF6   8B55EC                 mov     edx, [ebp-$14]
00431FF9   8B8704020000           mov     eax, [edi+$0204]

* Reference to: controls.TControl.SetText(TControl;System.String);
|
00431FFF   E84080FEFF             call    0041A044
00432004   33C0                   xor     eax, eax
00432006   5A                     pop     edx
00432007   59                     pop     ecx
00432008   59                     pop     ecx
00432009   648910                 mov     fs:[eax], edx

;=============================================================================
;
THIRD CALL
;=============================================================================

In here is our Serial compared and it it's correct then the good message will appear
else the bad message will appear...

here is what worked for me

Name:AcidCool 
serial:830-11080


Now, lets try one small example
I used the name AcidCool wich have the length 8 and will be acidcool on lower case.

a == 61h
c == 63h
i == 69h
d == 64h
c == 63h
o == 6Fh
o == 6Fh
l == 6Ch
Loop1 == 61h
Loop2 == 61h + 63h ==  C4h
Loop3 == C4h + 69h == 12Dh
Loop4 == 12Dh + 64h == 191h
Loop5 ==191h + 63h == 1F4h
Loop6 == 1F4h + 6Fh == 263h
Loop7 == 263h + 6Fh == 2D2h
Loop8 ==2D2h + 6Ch == 33Eh
Sum of "CrackThePlanet" == 569h
569h * 8h == 2B48h == 11080 in Decimal
33Eh == 830 in decimal
Serial == 830-11080
Final Thoughts
 

Well well, another Crackme keygenned with help of DeDe.. One brilliant tool for everyone that want to learn to keygen Delphi applications


 
Greetings to...


Special Greetings: 
LaZARuS for he's great tutorials....
+DaFixer for DeDe
The Cracking Answer for not even bugging me for writing or cracking anything, that group roxx!!!! You will get alotta work from me now soon :D
StealthFighter for good crackmes

Groups:  HF, ID, TCA, GC, TMG

Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Stealhfighter, Eddie Van Camper, CD_Knight and all the rest that i have forgotten
 

The end.
Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.