Hello.
Welcome back.
Our next project will be Visual C++ Crack Me by Saduz.
So go and download this from the resource section for this lecture.
The unzip password for this program is crackinglessons.com
.
After unzipping it, you will find two files.
Make a copy of the file just in case you need a backup or you made a mistake, you can have a backup.
After that, scan this with DIE to see whether it is a 32-bit or 64-bit program.
I've already done it and found that it is a 32-bit program, so I need to open it with x32dbg.
So I'll just do it here now by refreshing it since I did it before.
So now we run this first and see what happens when you run it.
It is a GUI program.
It asks for the username and I will key in, uh, cracker as the username, which I don't know whether it
is correct or wrong.
It doesn't matter.
For the registration number, I will assume it's 123456789.
So this is my assumed username and registration key.
So when I click okay, it gives me a message box with the bad message.
Try again.
So now I'm going to use a string search method to search for this string inside this program.
Try again.
So let me close this now.
So I right-click here.
Scroll down, search for current module string references, and I find try again over here.
Double-click it.
And I go to that memory where the string is found.
If I scroll up, I can see there is a good message here.
Good work.
Down here is the bad message.
Try again.
Now if I scroll further up, I will try to look for the start of this function.
So at the moment, I don't know where is the function.
Normally it's push -, but scrolling up I don't find any push -.
Instead, I find other message boxes and then followed by return here.
So I am not sure if the line that comes after the return is the start of the function, so I assume
it is.
If it's wrong, I can always find another starting point, so I assume this is the one.
So I put a comment here, mean, with a question mark to remind myself that I'm assuming that this
is the start of the function.
And then I will graph it by right-clicking and then graph.
And I can now look at this, uh, control flow logic.
And as I scroll down, I will find that there are two modules here.
Uh, two boxes.
The left is the bad message.
Try again, and the right is a good message.
Good work.
So now I will put a breakpoint here, right-clicking this, put the breakpoint.
And then I will turn on trace highlighting by going to Tracing, Trace coverage, enabling it, clicking on
word.
And then I will run.
So now I'm going to enter the name cracker and the password 123456789.
So I'll type in cracker.
As a name and 123456789 as the registration key, I click okay, and it hits my breakpoint.
Now I'll step over.
And then when I come to this line here, it is comparing - and -.
- is the first byte of the - register, which is 31 in hex, and 31 in hex is interpreted as the character
one in ASCII.
- is the first byte in the - register, which is 39, and 39.
As you can see from here, is a hex code for the character nine.
All right, so it seems that it is comparing one and nine.
So what is one?
One is my first character of the registration key.
One, that means it is comparing my first character with nine.
So this implies that the first password, the first character of the registration key, is nine.
Now we can confirm this by stepping over and see what happens over here.
Because the - is one and - is nine.
So obviously they are not the same because they are not the same.
Jump is not equal.
Jump will happen because they are not equal.
So now I click on the jump not equal.
And you see jump is taken.
That means it will jump to this address 401246, which is here.
So I step over, and it jumps there.
And then I continue stepping and see what happens to -.
- becomes negative one, which is bad.
That means the password, the first character, is wrong.
So first character is nine.
But I entered one.
That's why - is negative one.
So I continue to step over.
And now it's going to test whether - is zero.
So it is expecting - to be zero.
But instead, it finds that - is not zero.
It is negative one.
So jump not equal is true.
So it will jump.
Since this jump is taken, it will jump to 401271, which is here.
And it will push the message to the stack.
Let me try again.
And then it will now step over, and it will show the bad message.
Try again, coming from here.
So our hypothesis was right.
That means most probably the first character of the serial key should be nine.
So with that, we will now run again.
And then over here, we are going to enter the first character.
Change it to nine.
Click okay again, and again.
It stops at our breakpoint over here.
Let's step over.
Now it's comparing - and -, because we entered nine.
So it's true, both are same.
And now click on.
This jump is not taken, which means that it is not going to go to this address.
It's going to go straight.
Now it's going to test whether - is zero.
- is the first byte of the - register.
In this case, - is 39.
It is not zero.
So normally when you are comparing like this after a test on a character, it implies that you are testing
whether you have reached the end of the string.
In this case, it is not the end of the string because it is 39, it is not 0000, means end of the string,
which we have discussed before.
Zero zero means a null terminator.
A null terminator.
A null terminator denotes the end of a string.
So since it's not the end of the string, it is going to click on.
This jump is not taken because - is not zero, so it's not taken.
It's going to go straight.
And now it's going to compare - and -.
This time - is two.
Two is what we entered.
Take a look.
Two is what we entered for a second character.
So it is comparing that with -, which is three.
Three is a.
This suggests that three is a correct character.
So that means the second character should be three.
But we entered two.
So because it is not correct, it is going to click on this.
It's going to jump.
Jump is taken.
It's going to jump here, sets - to negative one.
And then come down to the bottom.
And again, test -, - is not zero.
It's negative one.
So jump not equal, jump is taken.
You go to the left, and again, it shows the bad message.
So now we click okay.
We know that the second character of the serial key is three.
So we run now, and we will enter the second character as three.
And now we click okay, and it hits our breakpoint.
So we step over.
First character is comparing, is nine.
This one here, this nine.
Continue stepping.
Now is comparing the second character, which is three.
It is correct.
We entered three.
So continue stepping.
And now it is going to test whether end of the string. It is not.
So it's going to look.
It's going to look back up, look back up here.
And then now it's going to compare the third character.
So our third character is three.
We entered three.
But it is comparing with two.
That means the third character is two.
So you keep on repeating like this.
Okay, so now it's going to show the bad message.
I'm just going to run to let it show the bad message.
Run again.
And now I'm going to enter the first three characters which were fished out, which is 932, 932.
Okay.
So at this point, I'm going to continue with the next lesson.
I'll see you in the next one.