Welcome back.
Now we are going to continue with our comment tracking technique.
So last lesson we stopped here at this call.
So let's see what is the parameter for this call.
So the parameter for this call is 123456789 which is our serial which we entered.
Let me just show you again we entered this 123456789.
And the second parameter is 7110 99731.
So this must be the actual serial key.
So we just copy this out.
It is comparing the two. String compare function compares two strings.
So right-click on this, copy line, and then open your notes.
And then paste your line here.
Right-click and paste it here.
So you got this serial key.
Let's see what happens next.
So let's step over the code.
And straight away you see - is negative one.
That means the comparison failed because you did not enter the correct serial key.
So the test here - is to test whether it's zero.
But we got negative one, not zero.
So when you come to the next
JNE.
So over here you will see it is not equal.
So it will jump to the left.
It will jump to the left because - is not equal to zero.
So now over here is jump to the left and now is continue to step over.
Now another call is about to be made and it's a string
compare again.
And now we see what are the parameters for this.
Again we have the first parameter as the key which we entered.
And another parameter, another parameter which is the actual serial key.
So right-click on this, copy line and paste down here.
So we got two serial keys now.
So continue to step over.
And it became negative one.
That means again failed because we did not enter the second serial key.
Now let's continue stepping over because - is not zero.
So it's going to jump to the left.
So let's see.
Jumping to the left again, another string compare.
Click on this and see the parameter.
First parameter is our serial key.
Second parameter is the actual serial key.
So now we fished out our third serial key.
Right-click, copy line and then come here and paste below.
So now we have three serial keys.
So click on this, step over.
And now we see it's negative one.
So it's testing for - value is zero.
It is not.
It is negative one. Step over.
So JNE will jump because it is not equal to zero.
So it's going to jump to the over here and then continue to step over.
And now take a look at this.
Just before this call - is zero.
When I step over it became one.
It became one, right?
So I put a comment there - 1, - 1.
And over here is testing whether - is zero.
In this case - is not zero.
- is the first byte of - which is 0 1. Because it is not equal to zero, JNE will take place.
It's going to jump to 401BE3.
So let's see.
Jump to the left and it's going to show the bad message.
Sorry.
Don't give up.
So step over this call.
And the bad message shows over here though.
Sorry, don't give up. Okay.
Click okay.
So now we know that over here it is expecting - to be zero.
So I'm going to update this comment.
Expecting
- to be zero.
- zero will be good because if - is zero, it means it will go to the right to show
great job cracker,
the good message.
Okay, so now we have fished out three serial keys.
We can test it to see whether they work.
So let's stop this debugging now and open directly the crackme and enter our username
which is cracker.
And let's test our keys one by one starting with the first one.
Click on this.
Select it.
Copy and paste in here.
Click on check.
Great job.
Now let's try the second one.
Copy and paste.
In here, click check.
Great job.
Let's test the third one.
So let's copy this.
Right-click, copy and paste it in here.
Click on check.
Great job.
So we have successfully solved this crackme by fishing all three serial keys.
So that's how we can use x32dbg to trace and fish out the serial key.
Now, in this lesson, although we did not use the comment tracking data
that we have already gathered, but I wanted to still show it to you because it is a useful skill to
have when you go on to more complicated crackmes where you need to figure out the serial key that is being
built line by line.
Right.
That's why you need to know the comment tracking method.
So that's all for this video.
I'll see you in the next one.
Thank you for watching.