Hello and welcome back. In this project,
we are going to crack this crackme and this is the author InDeineMama.
The name of the crackme is "Who Am I?"
So I have downloaded this for you.
So get the copy of the download from my resource section.
After you have downloaded, just unzip it.
The password to unzip is crackinglessons.com.
Remember that all the crackmes which you download from a website are zipped using this password, cracking
lessons.com.
So the reason why I zip them up is because sometimes they are falsely detected as malware.
So if they are wrongly detected as malware, your computer will delete the file or might not even allow
you to download it.
So that's why I have to zip them up first.
Now, all the crackmes are not malware, although your Windows Defender or antivirus might say they are
malware.
Now, the reason why some people say they're malware is probably because some of these software uses system
calls in order to clear the screen and so on.
So they're accidentally detected as malware.
So you can verify that they are not malware by debugging it.
As we will do, so a debugger should be able to tell whether a file is malware or not.
So when you debug, you can see that the files are not malware; they are simply just crackmes.
Another reason why certain files can become malware after a while is because when the people download
the files, the first thing they do is they upload to VirusTotal.
So VirusTotal will take your file and distribute it to all the, all the antivirus vendors, and every virus
vendor, antivirus vendors,
they will eventually classify this kind of files as malware because these are files which are, to them,
is classified as undesirable programsâ€”undesirable in the sense that you are not supposed to learn
how to crack them.
You are not supposed to learn reverse engineering.
All right.
That is undesirable.
So this is my opinion.
That's why all the files eventually get tagged as malware because they are undesirable as viewed by
this antivirus vendor.
So that's the reason why when the file first uploads, uh, on internet, it is not malware. But when
people who download it upload them to VirusTotal, after a while, if too many people upload them to VirusTotal,
eventually the file becomes tagged as malware.
Okay, so now let's get started.
So the first thing we do is to scan it with, uh, with the Detect It Easy to see
what, uh, what, uh, what is it? A little bit or is it 64-bit?
And you will see that it is a 32-bit program.
That means we need to use x32dbg to open it.
Before we open it, we will run it first to see what it does.
And it asks, "Who am I?"
So we don't know.
So we just say anything.
Maybe we say we are cracker.
Hit enter and it says wrong.
So this is an easy one to crack.
So can you try this on your own?
Now pause the video.
See if you can find the correct username.
All right.
I hope you've given it a try.
And this is how I will solve it.
So there is an easy way and a difficult way to solve it.
The easy way is to use a hex editor to look for all the strings in a file, and you will find that there
are certain strings which are revealing.
Then you can guess that those are the correct username. But using a hex editor can only work for easy
crackmes like this one.
For the more difficult, advanced crackmes, hex editor will not show you anything.
It will not show you the username or the password.
So that is the reason why, even though in this particular category you can do it using hex editor,
I will always want to show you how to do it the correct way by debugging it with a debugger.
So once you have learned the skills of how to debug it with a debugger, you can crack even more advanced,
difficult crackmes.
So let's get started.
So now, remember, the bad string is "wrong."
Here we are going to search for this string inside the debugger.
So remember, "wrong" is the string that we are searching for.
So we open the x32dbg.
Now open the crackme. Before you open the crackme, you should make a copy of the
crackme.
It's a good habit to always make a copy in case something goes wrong.
You have a backup.
So now we are going to right-click here and search for the string.
Search for current module string references.
And then now we are going to filter out the phrase "wrong," wrong, wrong.
There you go.
And click on the address to go over there and analyze it.
So over here you can see this is the string where the, where the it appears in memory.
So now we can analyze it by scrolling up to look for the main function.
The start of this function should be the main function.
If we scroll up here, you can see other strings like "that right" and so on.
And then, then other strings here and so on.
And then this is CLS, clear screen, and system call here.
So this is the system call which makes the antivirus think that this is a malware.
That's why it's a, it's a false positive.
As you can see here, there's nothing, nothing dangerous here.
All this program doesn't steal the password, doesn't, doesn't crash, doesn't, doesn't encrypt your files
or anything like that.
You can see very clearly.
It's just a simple, short main.
So now we should put a breakpoint here.
I already put a comment there to remind yourself where we are.
So we now put the breakpoint, and then we will, uh, now step away.
So turn tracing on first word, and then we start with line by line.
But before that, let us run first until it hits the breakpoint.
So it has hit the breakpoint.
Now you can step over line by line.
So it's going to make our first call.
Keep a lookout on the right console.
Nothing happens here.
Also nothing.
Next call.
Nothing happening.
Next call.
Nothing happening.
Next call.
Nothing happening.
Continue to step over until something appears in the console.
Okay, so this call has got, uh, this parameter "cout," which is a C++ function to print something
to the screen.
You can see here also the parameter for this call, uh, this function call has got these parameters.
One of it is the "whomi" string.
And the other one is your "cout" function.
So it's going to execute the "cout" function
to print this string. Let's step away.
And there you are.
So now let's, uh, continue to step over.
So this call is now going to read your input because you can see from the parameter here,
this calls "cin," "cin," the C++ function to read the input from the console.
So let's step over until this thing pauses, becomes running state.
So now it's in the running state.
That means it's waiting for us to type something.
So we will type "cracker."
Cracker. Hit enter.
And now it comes back to pause state.
That means we can continue stepping over.
So let's continue stepping over.
Now this call here, before the call,
the value of - is like this.
Step over.
After the call, it becomes all zero.
So normally all zeros or all Fs means that something is wrong.
It means either your username is wrong or the number of characters is wrong.
So this is an important function to examine.
So I put all the comments here to make it easy for you to follow along.
Like, for example, here shows the prompt "Who am I?" Here reads the input.
This call sets - to zero.
Later on we'll come back and analyze this.
So continue to step over, and over here is going to jump or not to jump depending on -, is depending
on the value in - because - is moved to -.
So - is actually the last byte of -.
So it is zero, zero.
So zero, zero is moved to -, and - now becomes all zero.
Now it's going to test -, is it, is - zero?
In this case, - is zero.
Therefore the jump equal will happen.
It will jump to the address ending with C95, which is here.
So let's continue to step over.
Okay.
Now over here is going to show something in the output because of the parameter is a "cout" for this call.
So let's step over and you see the bad message showing "wrong."
So this call shows a bad message.
So I put a comment here.
So now we know that the when it, when it came over here, it jumped to the left.
That's why you are seeing a bad message.
So we probably joined
to the right would be the good message.
Now why does it go to the left is because of - is zero.
So we have to analyze this call in detail now.
So we put the breakpoint here.
And then in the next lesson we are going to step into this call to see what sets the return value of
- to zero.
So I'll see you in the next lesson.
Thank you for watching.