Hello.
Welcome back.
In the previous lesson, we've already managed to create a self keygen.
So if I enter any kind of username and just any fake serial, I click check.
It will generate the keygen.
Now in this lesson I'm going to improve the message box by adding a caption here.
So let's get started.
So we're going to put the caption key here.
So we have to now go back to the x32dbg.
Let's close this first.
Open my.
Then I will run.
Enter any kind of name and serial.
And go back to our main here.
And then I'm going to let it run until it hits this breakpoint.
Put a breakpoint here.
So run into that breakpoint.
Now this breakpoint is where it's starting to move all the parameters for message box to the stack.
So let's revise what's the message box parameters.
So if we search for MSDN message box you will see that the message box parameters are as follows.
The fourth parameter is the type.
The third parameter is a caption.
So this is the caption.
The second parameter is your string, your string.
So if you look at this one, second parameter is your string.
First parameter is the owner or the parent for the message box.
So we are just interested in that.
We are just interested in the caption which is the third parameter.
So counting from the bottom.
First parameter.
Second parameter.
Third parameter.
Let me just refresh this.
Okay.
So now how do we change this third parameter to show a caption?
The caption that we want to show is the string key.
Now to do that we have to move an address which contains the string key.
At the moment the address is 441026.
So you click on this.
Let's step one and go there.
Now if you click on this now you can see that this address.
Let's go there.
Now follow in dump.
Follow the address - plus eight.
And we go there.
Now we will see that it has got nothing there.
Blank.
That's why there is no caption.
All right.
So what we need to do is to put a caption for this.
At this memory address we can put the caption there.
So one way to do that is to just select all this.
Right?
Okay.
We need three bytes so key.
And then right-click and binary edit.
And under here we type key K-E-Y, keep size and click
okay.
So now it's got the string key there.
And now when we step over it's supposed to move that key string to that address.
And let's step over and call the message box and see whether we get it.
It fails to work.
Now that could be because this address was either not editable or maybe that particular
address has been overwritten by some other values.
So in order to solve that, we have to create a string in another separate memory address.
And we need to find a blank memory address which is not being used, and then write our string there.
So let's get started now.
So to know which memory address we can use, we can go to memory map here.
And then look for data.
Make sure it's readable and writable.
So RW means readable and writable.
Double-click on that data there.
And now you are coming to that data section.
Now at the data section here.
Scroll down until you see all zeros.
So this is called a code cave.
A code cave is a writable area of memory where you can insert additional text or code.
So choose something that is all zeros.
For example here.
Select three bytes.
Right-click it and then select binary edit and then go to the ASCII box and type key K-E-Y.
And then click okay.
So now you have your key and make sure at the back is all dots.
The last byte here is your null terminator that terminates the string.
Now take note of this address.
We want this address.
So right-click and copy the address and then paste it inside your text editor.
So we want this address because this address contains the string key.
Now you come back here and then we go to this location.
Right-click, follow in disassembler.
And then this is where we need to change the address.
Presently it's 441026.
So we need to assemble it.
Press spacebar.
And over here delete this and paste our address.
Our new address that contains key 44010.
Click okay.
See.
So it's there.
Now let's run again.
This time we are going to click check again.
Click run again.
And you see now our message box has got a caption key.
Okay, so let's patch it now.
And then click patch file and we are going to call it keygen this and then call it three, three dash
self keygen, click okay.
So now we can test our new self keygen version three.
Enter any username.
Enter any wrong serial.
Click on check.
And there you have it.
Our nice message box with a helpful caption key.
All right, so let's copy down this key and see whether it works.
So our key now let's say
61106110111636.
All right, so let's copy this.
Paste it here.
Click check and it works.
See?
So this is how we can improve on our self keygen by using code cave to insert additional text
and then copying that memory address for the text into the message box parameter for the caption.
That's all for this video.
Thank you for watching.