Welcome back to a new lesson.
In this project we are going to try this crackme by this author.
So go and download this from the resource section for this lecture.
Unzip it. Zero keygenThis.
The unzip password is crackinglessons.com, and then make a copy of the crackme as a backup in case
you make a mistake.
And now we shall run it and see what it does.
Just double-click on it and it asks you to enter the name and the serial.
So I'm going to use "cracker" as the name.
I suggest you follow the same so that you can follow along with this lesson.
And the serial I'm going to assume is 1, 2, 3, 4, 5, 6, 7, 8, and (912) 345-6789.
When I click on check, it gives the error message "Sorry, don't give up."
So remember this string.
We are going to search for this string inside the string search later.
You should also scan this with DIE to check if it is a 32-bit or 64-bit program.
I've already done that, and I found that this is a 32-bit program, so I need to open this with
x32dbg.
So I just click on this.
Now remember the string "don't give up."
To close this you need to press Alt+F4.
So let's fire up x32dbg and then open the crackme.
So I've already done it before, so I just need to refresh.
So let's search for the string.
Don't give up.
Right-click here.
Search for current module string references.
And then just look for "give up."
So there you find it.
You found it.
Sorry.
Don't give up.
So click on here to go to the address, and you will find that this is the bad string.
And then also a good string for that.
Great job.
And then we are now going to scroll up to look for the start of the function which contains these strings.
So continue to scroll up, and you should come to the main function which I've labeled here.
This is a push, indicating the start of the function.
So I put a comment "main" there, and I also put a breakpoint.
So let me remove my other breakpoint.
Start afresh.
So now we can graph this.
Just right-click on it and click on graph.
And now we shall turn on trace.
Trace.
Highlighting mode.
So you're ready to start.
So let's click on run until it hits the breakpoint.
So now the window shows them the dialog.
So now we enter our username.
Cracker. And I will assume
password 123456789.
So remember this is our assumed username and this is our assumed password.
So now we click check and it hits our breakpoint, and we start tracing.
So we hit.
We come to this call. Notice - and now we step over and - becomes seven.
So seven is probably the number of characters in our username.
1, 2, 3, 4, 5, 6, 7.
So I put a comment there.
Continue stepping over.
Now we are comparing - with the stack -.
So - is zero and the stack is seven.
So it's comparing zero with seven.
And click on the step over now.
JGE stands for jump if greater or equal to.
So if - is bigger or equal to the stack, then it will jump to 41401879.
So in this case it's not taken because - is zero.
Click on this.
- is zero which is less than seven.
So it's not going to jump to here.
So continue to step over.
Now note that I made a comment like this: - equals to zero, one, two, three.
- is seven.
So - is a stack here.
This is -.
So when you first run this program, you will enter the loop one time.
This is a loop by the way.
You can see it coming here and there's a loop coming back here.
So this will keep on looping a few times.
The first time we loop - is zero.
So I put zero here.
The rest I still don't know.
I don't know that the next loop is going to be one or two or three.
So the first loop is zero.
So I just put zero.
But I've already done this before.
That's why you see 1, 2, 3 and so on.
But for your case you just put zero first and then - 7, - 0.
- seven.
That's how you start your first comment.
And then now you continue to trace by stepping over.
Step again.
Notice now it comes back to the loop.
It came down here and then loop up.
And now it came back here.
And now we step over again.
And this time click on.
This is comparing one with seven.
So now - will become one.
So you update your comment to put zero, one.
And then the back is still the same - equals seven.
So again the test here will fail because - is less than -.
It is not larger than.
So this jump will not happen.
So it's going to go to the right and then next loop again come back here. Click on this.
And now you see - has become two.
And it's comparing two with seven.
So update the comment.
Now put two here, comma.
And then here at the back seven, same.
So continue to step over here again and again.
Click on this.
Now click on this.
Now you see - is three.
So it's comparing three with seven. Okay, continue.
Continue stepping over.
Click on this.
Now is comparing four with seven.
Okay.
Now it's comparing.
Click on this.
You see it's comparing five to seven.
Again, five is less than seven.
So it will not jump.
It will go to the right.
Now it's comparing six to seven.
Again, you go to the right.
Click on this. Now is comparing seven, seven.
Yes.
So this is true.
So because seven isâ€”- in - is also same, same as the value in - which is seven.
Remember you need to update this every time it loops so that by the time it comes to this,
seventh iteration, you should have 0, 1, 2, 3, 4, 5, 6, 7 commented here.
So this is called the comment tracking method.
It allows you to keep track of the behavior of the program each time it loops.
That way you can understand what is happening.
So you can see here from the history - was previously originally zero, - was seven, then the second
loop - became one, - is still seven, third loop - became two, - seven and so on.
So this history of the commenting here helps you understand the code, the method. Right now,
this
method is useful in future because it will help you understand how the serial key or password is
being created.
So now because - is equal to seven, so jump will take place. You click on this. Now because
JGE means jump if greater than or equal to.
In this case it's equal to.
So it's going to jump to 401879.
So we click on this, we see jump is taken.
So now it's going to go to the left.
Okay.
So now again here is going to call this. Notice -.
After you call this - became seven.
So you write a comment here - equals seven. Right.
This is also part of your comment tracking method.
Continue to step over until you come to another call which is here.
Now notice - after you step over it became nine.
So you comment again nine, so you get seven, nine here, and then come to the next call.
You stepped over.
It became seven.
So put your comment there.
- equals seven.
Continue to step over.
Now we're going to jump. Move this, step over this and become eight.
- became eight.
So put the comment that - eight.
Now we come to this, you will notice - when you step over it became seven.
Continue stepping over.
Now over here.
After you step over.
See what happens.
- became eight.
Continue stepping over.
All right.
So now we come to this part.
So at this point I'm going to stop this lesson.
And we'll continue in the next one.
See you then.