Author | Acid_Cool_178 |
Target | 2Sweet Crackme 2.C |
Download it from | http://2Sweet.tsx.orx |
Public Release | 20 March 2001 |
Author Contact | acid_cool_178@hotmail.com |
Dedication | Goes to 2Sweet and +DaFixer for DeDe |
Difficulty Level (1..7) | 3 ( Easy-Medium) |
Tools Required | DeDe (I'm are using version 2.50) |
Download it from | http://www.protools.cjb.net |
|
Back
in the keygenning skills and I made it again.... I founded back my DeDe tool and
worked out some new things, I'm still working on another crackme, and it's more
fun ;) alotta work on me.... hehehehehe, I love it to the maxxxx....
|
This crackme have one name and serial, we will keygen this crackme so we have to understand the algorithm on this app, that's why +DaFixer have made DeDe, it's so easy to use that MS can cry...
And now you will see this, and here is also the debugging code for us :) The Serial algorithm is in here....
00442205
64FF30
push dword ptr fs:[eax]
00442208
648920
mov fs:[eax], esp
0044220B
8D55FC
lea edx, [ebp-$04]
* Reference to
control TForm1.Edit1 : TEdit <-- Gets the Name
|
0044220E
8B86D0020000
mov eax, [esi+$02D0] <--EAX ==
Name
* Reference to:
controls.TControl.GetText(TControl):System.String; <--
Gets the name
|
00442214
E8CB0FFEFF
call 004231E4 <-- Executes the
function
00442219
8B45FC
mov eax, [ebp-$04] <-- EAX ==
Name
* Reference to:
system.@LStrToPChar;
|
0044221C
E8D719FCFF
call 00403BF8
* Reference to:
sysutils.StrLen(System.PChar):System.Cardinal;<--
Gets length of name
|
00442221
E89E56FCFF
call 004078C4 <-- executes the
function
00442226
8BC8
mov ecx, eax <-- ECX == Length
of name
00442228
BB01000000
mov ebx, $00000001 <-- EBX == Counter
1
0044222D
B801000000
mov eax, $00000001 <-- EAX ==
Counter 2
00442232
3BC1
cmp eax, ecx <-- Compare Length
of name with ECX
00442234
7F0F
jnle 00442245<-- Jump if EAX == less
than Counter 2
00442236
8B55FC
mov edx, [ebp-$04] <-- EDX ==
Name
00442239
0FB65402FF
movzx edx, byte ptr [edx+eax-$01] <-- Takes
one char of the name
0044223E
40
inc eax <-- Increases EAX
0044223F
03DA
add ebx, edx <-- EBX == EBX+EDX
00442241
3BC1
cmp eax, ecx <-- IF all chars
are done then
00442243
7EF1
jle 00442236<-- skip this jump
00442245
8BC3
mov eax, ebx <-- EAX == the
result if the calculation
00442247
C1E004
shl eax, $04 <-- SHL EAX,4
0044224A
03C3
add eax, ebx <-- EAX == EAX +
EBX
0044224C
8BD8
mov ebx, eax <-- EBX == EAX
0044224E
8D55F8
lea edx, [ebp-$08]
00442251
8BC3
mov eax, ebx
* Reference to:
sysutils.IntToStr(System.Integer):System.AnsiString;overload; <--
Convert the HEX to ASCII Decimal
|
00442253
E8E053FCFF
call 00407638 <-- Executes the
function
00442258
8B45F8
mov eax, [ebp-$08] <-- EAX ==
Result of the conversion
0044225B
50
push eax
0044225C
8D55F4
lea edx, [ebp-$0C]
* Reference to
control TForm1.Edit2 : TEdit <-- Focus on the
serial field
|
0044225F
8B86D4020000
mov eax, [esi+$02D4]
* Reference to:
controls.TControl.GetText(TControl):System.String;<--
Gets the serial
|
00442265
E87A0FFEFF
call 004231E4 <-- Executes the
function
0044226A
8B55F4
mov edx, [ebp-$0C] <-- EDX ==
serial
0044226D
58
pop eax
* Reference to:
system.@LStrCmp; <--
Compare the serials
|
0044226E
E8D118FCFF
call 00403B44 <-- Executes the
function
00442273
750C
jnz 00442281 <-- jump if the
serial was wrong
* Possible String
Reference to: 'WELL DONE !' <--
The good message
|
00442275
B8C4224400
mov eax, $004422C4 <-- EAX ==
the good message
* Reference to:
dialogs.ShowMessage(System.AnsiString); <--
Shows the good message
|
0044227A
E845F9FFFF
call 00441BC4<-- Executes the
function
0044227F
EB0A
jmp 0044228B <-- Jump to the
end of the routine
* Possible String
Reference to: 'INCORRECT PASSNUMBER'<-- Bad
message
|
00442281
B8D8224400
mov eax, $004422D8 <-- EAX ==
Bad message
* Reference to:
dialogs.ShowMessage(System.AnsiString); <--
Shows the bad message
|
00442286
E839F9FFFF
call 00441BC4 <-- Executes the
function
0044228B
33C0
xor eax, eax <-- EAX == 0
0044228D
5A
pop edx
0044228E
59
pop ecx
0044228F
59
pop ecx
00442290
648910
mov fs:[eax], edx
Lets take one small
example in here
Name == AcidCool
Now
the length of the name is 8 so it will be 8 loops for us to take
Loop1
A == 41
41 + 1 == 42
Loop2
c == 63
42 + 63 == A5
Loop3
i == 69
A5 + 69 == 10E
Loop4
d == 64
10E + 64 == 172
Loop5
C == 43
172 + 43 == 1B5
Loop6
o == 6F
1B5 + 6F == 224
Loop7
o == 6F
224+6F == 293
Loop8
l == 6C
293 + 6F == 2FF
After Loop8 so is 2FF the result from every char on the name plus ONE.
Take the result and so one SHR,4 and then my result was 2FF0
Now we got two values, 2FF and 2FF0, they is added together'
2FF + 2FF0 == 32EF
32EF to decimal and you have your serial... Mine was 13039 and it worked for the name :)
I got the idea at one
example from NeO'X'QuiCk and that really roxx dyed. I have your tutorials
man, keep up the good and fantastic work !! Special Greetings: Groups: HF, ID,
TCA, GC, TMG
LaZARuS
for he's great tutorials....
+DaFixer
for DeDe
The Cracking
Answer for not
even bugging me for writing or cracking anything, that group roxx!!!! You will
get alotta work from me now soon :D
NeO'X'QuiCk
for your spirit and ideas on working.
Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton,
Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper,
CD_Knight and all the rest that i have forgotten
Any mistakes, corrections, or comments
may be mailed to the members individually, or to the group :
hellforge@hellforge.org.