Author Acid_Cool_178
Target 2Sweet Crackme 2.0
Download it from http://2Sweet.tsx.orx 
Public Release  14 Febuary 2001
Author Contact acid_cool_178@hotmail.com
Dedication Goes to 2Sweet and DaFixer for DeDe
Difficulty Level (1..7) 3 (Easy/Med)
Tools Required DeDe (I'm are using version 2.44)
Download it from http://www.protools.cjb.net 

 

Introduction
 

Wellwell, I'm are falling into love now... Cracking are getting more fun when you now how to keygen things and my skills are growing realy fast right now, I can't evern understand how fun it is right now... But I'm are only cracking for one purpose, to learn and to protect my programs better when I will get myselfh a job ad one coder in the enar future... That's all and I wan't to provide my information with the rest of the world.

Again, we will crack on 2Sweet's crackmes, I founded them intressing so i will work on them for a while and keygen them all (I hope) the crackme are included into this zip file.... 

 

Tutorial
 

Well, time to get to now the crackme again. Run the crackme and you will now fnd 2 edit fields, the one are the UserName and the other are the serial... I will use 666 as my UserName and 2951 as my Serial. I tested it but I got the message "SERIAL NUMBER IS INCORRECT" and it realy are.... and 666 in decimal are 29A in HEX

We will follow our standard Delphi progress

We will follow the same stepas as we did with Crackme 1.0 

  1. Open DeDe
  2. Open File and select dcm20.exe
  3. Click on the Process Button and now DeDe are disassembeling the crackme
  4. Follow the instruction under the Disassembeling
  5. Goto the procedures tab in DeDe
  6. Select TForm1 and Button1Click  

Step number 6 are only a great guess but i was sure that this was the right place when i founded the bad message when I scrolled down. 

Now, here is all the important code that you ever will need to now about this crackme

* Reference to: Controls.TControl.GetText()            <-- Gets some text
|
00442A13   E89C08FEFF             call    004232B4     <-- Gets the username (29A)
00442A18   8B45FC                 mov     eax, [ebp-$04] <-- EAX == Username (EAX == 29A)

* Reference to: Sysutils.StrToInt(System.AnsiString)
|
00442A1B   E8504CFCFF             call    00407670
00442A20   8BF0                   mov     esi, eax    <-- ESI == Usernumber
00442A22   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TForm1.Edit2 : TEdit
|
00442A25   8B83D4020000           mov     eax, [ebx+$02D4]

* Reference to: Controls.TControl.GetText()        <-- Get's some text
|
00442A2B   E88408FEFF             call    004232B4 <-- Gets the Serial
00442A30   8B45FC                 mov     eax, [ebp-$04] <-- EAX == Serial

* Reference to: Sysutils.StrToInt(System.AnsiString)
|
00442A33   E8384CFCFF             call    00407670
00442A38   8BD0                   mov     edx, eax    <-- EDX == Serial
00442A3A   81C641010000           add     esi, $00000141 <-- Usernumber + 141 (29A + 141 = 3DB)

* Reference to field TEdit.OFFS_00D5
|
00442A40   8D86D5000000           lea     eax, [esi+$00D5]    <-- EAX == EDX + D5 (3DB + D5 = 4B0)
00442A46   8D0440                 lea     eax, [eax+eax*2]    <-- EAX == EAX * 2 (4B0 + 4B0 * 2 = E10)
00442A49   2D89000000             sub     eax, $00000089      <-- EAX == EAX - 89 (E10 - 89 = D87)
00442A4E   3BC2                   cmp     eax, edx            <-- Compare the Entres serial with the correct serial
00442A50   750C                   jnz     00442A5E           <-- If not corect serial then jump to the bad message 

* Possible String Reference to: 'CRACKED !!!'        <-- YESS :D
|
00442A52   B8C02A4400             mov     eax, $00442AC0        <-- EAX == Good message

* Reference to: Dialogs.ShowMessage(System.AnsiString)
|
00442A57   E838F2FFFF             call    00441C94            <-- Shows the good message
00442A5C   EB0A                   jmp     00442A68            <-- Jump to the program 

* Possible String Reference to: 'SERIAL NUMBER INCORRECT'        <-- Bad Message
|
00442A5E   B8D42A4400             mov     eax, $00442AD4        <-- EAX == Bad Message

Well, again I have managed to keygen one Delphi crackme.. I just love this shit.. 
Here are my Ollydbg notes of you would like to see them, I used OllyDbg first but I have grown in skills to keygen at this crackme too....


00442A13   . E8 9C08FEFF    CALL    dcm20.004232B4                   ;  Get's out UserNumber
00442A18   . 8B45 FC        MOV     EAX,DWORD PTR SS:[EBP-4]         ;  EAX == UserNumber
00442A1B   . E8 504CFCFF    CALL    dcm20.00407670
00442A20   . 8BF0           MOV     ESI,EAX                          ;  ESI == UserNumber
00442A22   . 8D55 FC        LEA     EDX,DWORD PTR SS:[EBP-4]
00442A25   . 8B83 D4020000  MOV     EAX,DWORD PTR DS:[EBX+2D4]
00442A2B   . E8 8408FEFF    CALL    dcm20.004232B4                   ;  Gets the serial
00442A30   . 8B45 FC        MOV     EAX,DWORD PTR SS:[EBP-4]         ;  EAX == Serial
00442A33   . E8 384CFCFF    CALL    dcm20.00407670
00442A38   . 8BD0           MOV     EDX,EAX                          ;  EDX == Serial
00442A3A   . 81C6 41010000  ADD     ESI,141                          ;  UserNumber + 141
00442A40   . 8D86 D5000000  LEA     EAX,DWORD PTR DS:[ESI+D5]        ;  EAX == ESI + D5
00442A46   . 8D0440         LEA     EAX,DWORD PTR DS:[EAX+EAX*2]     ;  EAX == EAX+EAX * 2
00442A49   . 2D 89000000    SUB     EAX,89                           ;  EAX == EAX - 89
00442A4E   . 3BC2           CMP     EAX,EDX

And that was all from me and this crackme notes... It are totally reversed but i have some problems with my win32ASM keygen and I havent tried in Visual Basic yet.. Will do it now. 

EYY 

I'm are a master....

HEre is the VB6 source


Private Sub Command1_Click()
Dim user
Dim serial
usernumber = Text1.Text
serial = usernumber + 321 + 213
serial = serial + serial * 2
serial = serial - 137
Label1.Caption = serial
End Sub

And you can also find the keygen in the zip file...

Final Thoughts
 

I'm are not proud over my win32asm skills, i thought that they were better but i had proglems to make one keygen for this program... I'm are a lamer in other words..... Now, I will strp down and take a break and think what the hell were wrong.. This was one kick in the face for me and I won't release this tut for any groups before the keygen in Win32ASM are finished... 

Acid_Cool_178 is logging out and leaving to he's girlfriend now.... Cya 


 
Greetings to...



Special Greetings: 
czDrillard 4 making he's crackme 2 that was the first one i understood 150% perfect
LaZARuS for he's great tutorials....
+DaFixer for DeDe

Groups:  HF, ID, TCA, GC

Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper, CD_Knight and all the rest that i have forgotten

 

The end.
Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.