Cheat Engine

Ksbunker · Posted: Tue Jul 10, 2007 4:57 am Post subject: [Keygenme] Keygenme#2 by Ksbunker

Author: Ksbunker
Lang: ASM

Difficulty: 2/10

Goals:
1) Fish a valid serial
2) Write a keygen

Rules:
1) No patching

About:
I've introduced a little trick, I wonder if you can spot it. (May cause some unexpected serials)

DevilGilad · Posted: Tue Jul 10, 2007 4:59 am Post subject:

I'll try it out :]

tfo · Cheater Reputation: 0 Joined: 13 Aug 2006 Posts: 28

1) tfo@CEF:13FE465-1C00465

haha01haha01 · Posted: Sun Jul 15, 2007 2:53 am Post subject:

argh that test command is always on ur keygens on the critical lines... its always

Ksbunker · Posted: Mon Jul 16, 2007 3:57 am Post subject: re:

Extract of "Art of Assembly"

haha01haha01 · Posted: Mon Jul 16, 2007 6:03 am Post subject:

wow thx for instruction.
btw and is the command that put the number into binary then put it one on another and if there is 1 and 1 it writes 1 else its 0?
like AND 101,110
101
110
-----
100

am i right?
if so there is no code that can match ur crackme cause anding a num on itself will never get 0
O.o

~srry for being noob~

aha..............
theres only 1 case where a serial would be correct... when eax will turn into 0.....................................
that pop up an idea in my head.....

so lemme get it... to crack ur crackme... i need to find the only combo of id+serial that will create 0 as eax... that wont take along time.... Twisted Evil

*evil laugh in the dark castle while thunder storm is going outside*

reporting logic: b4 eax is tested, ebx is moved into him, and b4 ebx moved into him he gets imuled with itsels and some other number, ebx CANNOT be 0 in any other way beside the emul line, cause right b4 it theres a line of "add ebx,eax", and b4 this there an "add eax,some number" and there are no more lines that modify ebx or eax after this. take alook at the code it will make ur life easyer:

Ksbunker · Posted: Mon Jul 16, 2007 6:27 am Post subject: re:

The "TEST" instruction is after the lstrcmp() function.

So EAX is not anything to do directly with the serial but rather the result of the lstrcmp() call.

The return value of lstrcmp() dictates that if the two strings ARE equal, the return value is 0 (i.e. EAX = 0), if the strings ARE NOT equal, the return value is 1. (i.e. EAX = 1).

Hence, the use of instruction "TEST".

haha01haha01 · Posted: Mon Jul 16, 2007 6:40 am Post subject:

whats the istrcpm() thing and where is it? is it the commands that hiding between the lines?
ohhh.... its that thingy... told ya im bad at those stuff... well im bad at all hacking stuff but w\e Smile

ill keep looking it....

EDIT:OMG... PLEASE DONT TELL ME IM DREAMING.... I FOUND A VALID PASSWORD!!!!!
THE USERNAME "ASDASD" MATCH THE PASS "EB41CC-EBA1CC"

OMGOMGOGMGOMGOGMGOGMOGMGOGMGOMOGMGOMGOGMGOGMOGM

FOUND ANOTHER 1!!!!!!!!
asdasd = 147108C-147508C
btw, i still dont get the way it choose serials but ill soon find it out.

Ksbunker · Posted: Mon Jul 16, 2007 7:08 am Post subject: re:

Link to common string function, inc. lstrcmp();

http://msdn2.microsoft.com/en-us/library/ms647488.aspx

haha01haha01 · Posted: Mon Jul 16, 2007 7:11 am Post subject:

omg omg omg i know how to get serial for all user that i want but omg i cant write a software for this cause i dont get the way that crackme choose the serials....

kai kai i got the lstrcmp thing but i dont get what is the calculation to reach the serial.... i can find a matching serial to all username in the world but i cannot build a software that will do it...

wopwowowowowowowow!!!!!!
omg!!!!!!
i patched ur program so it will msgbox me the correct serial!!!!
beware Ksbunker! im soon done with it! just nopping all ur code... and i will get a keygen!

last, but not least, i am proud to upload my 1st keygen!
(btw because im such bad programmer i just made ksbunker crackme msgbox the correct serial, so ignore the "serial" box.)

Ksbunker · Posted: Mon Jul 16, 2007 10:06 am Post subject: re:

That's awesome man, keygen injection they call what you did.

Works really well man.

Good work!

haha01haha01 · Posted: Mon Jul 16, 2007 10:13 am Post subject:

lol k

btw how can i find out what was the calculation to get the serial?
cause on ur first keygenme there are no msgboxes so i cant do the same trick like here =( and even if i go to the place that the strings are pointing to i cant find anything in there Crying or Very sad

so how do i find it out O.o

Ksbunker · Posted: Mon Jul 16, 2007 11:52 pm Post subject: re:

Just think logically about it.

The entered username is read using GetDlgItemText(), and finally the valid password and compared against the original password using lstrcmp().

So the routine responsible for generating the password from the given username, MUST reside somewhere between GetDlgItemText() and lstrcmp(). Have a look at GetDlgItemText(), particularly the parameter that stores the read value and begin to trace it, watch where it goes, etc...

haha01haha01 · Posted: Tue Jul 17, 2007 1:11 am Post subject:

O.o
kk.
i found something interesting else.
at the line of "string 2", and at line of "text" in the msgbox command
the command was to push an address.
if i went to this address nothing was important there, but when i put the address of the string 2, as the command of the text in the msgbox, i got the valid serial (string 2)
actually the way ur crackme work is to take the username and somehow change him with some sort of calculation, then the target is actually that the serial and username will be the same thing.