Hello and welcome back.
We are now going to do another keygen project, and this is the credit I am giving to the author,
Submin King.
Please download the keygen crackme from the resource section for this lecture.
The password to unzip it is crackinglessons.com.
After you've unzipped it,
inside you'll find two files.
Just make a copy of the original and then scan it with DetectItEasy to find out if it's 32-bit or 64-bit.
I've done that and I found that it is 32-bit, so I need to use the x32dbg.
Let us first run it to see what it does.
It is a graphical user interface and you are supposed to enter the name.
You don't know the name,
so I'm just going to put "cracker" and the serial. I don't know the serial,
so I'm just going to put 123456789.
And then I will click check.
But there is no message box pop-up which should tell you that you have entered the wrong serial.
So without a bad message box, can we still crack this? The question is,
the answer is yes.
We use another technique called the intermodule calls technique.
So we shall now open it with x32dbg.
We will close this first.
Open it with x32dbg.
I am going to refresh because I've already done this before.
And now we need to do an intermodule call.
So we just right-click this and then search for current module,
intermodule calls.
Intermodule calls are the Microsoft API functions which are being called by this program.
So once you do a search, it will list out all the intermodule calls which this program uses.
Now of interest to us would be your MessageBox API.
So just scroll, scroll down,
or if you don't want to scroll to look for it, you can just filter it out here by typing "MessageBox."
And you will find there is one here.
So the MessageBox is being used to display messages.
In this case, it is going to be used to display the congratulatory message.
We know that it doesn't display the error message when you enter the wrong serial, but we suspect
it will display the congratulatory message if you enter the right serial.
So that is the reason why we are filtering out for MessageBox.
So just click on this to go to the address and you will find that this is the location.
So we right-click and put the breakpoint there,
toggle, just to mark the spot.
And true enough, there is a congratulatory message.
"You did it!
Congrats!
Make me a little tutorial please."
And if you scroll up, you try to look for the start of this function.
But there is no push -,
but there is something here.
So maybe this is the start of the function, but we are not sure.
So we can see there's a GetDlgItemText. GetDlgItemText is used to read in the text from
the text box.
Let me show you.
So I open this.
This is called the text box.
There are two here.
So the function that is used to read the text is GetDlgItemText.
This one here.
So most probably you will need to call this twice because there are two fields here: the name text box
and the serial text box.
Okay.
So now we are going to put our graph here somewhere.
Maybe here, if you want. Just right-click this and graph it.
And there you go.
It gets the dialog item text,
and then after that it will go down and perform all this.
Maybe it's too low.
Maybe let's go higher.
Move it up here.
And then from here we graph it and we see there is the start of this function.
GetDlgItemText
is here.
And then if you go down further down at the bottom on the right, you will see there is a congratulatory
message here.
So before it can come to this congratulatory message, it will need to read in the data
that you entered using the GetDlgItemText, which is over here.
So it's a good idea to put the breakpoint here. Right-click and put a breakpoint and then turn tracing
on: trace coverage word, and run the program.
Move this to the side so it doesn't block our view.
Now we're going to assume that the username is "cracker" and serial is 1234567,
eight, nine.
Now you click on check and it hits our breakpoint and we shall start tracing by stepping over
it.
So let's step over that.
Okay.
It hasn't called this yet.
It's just moving this to -.
And - now contains the GetDlgItemText and it will be called over here: call -.
So it's calling this function here. - contains the address of this function.
And then I put a comment here:
GetDlgItemTextA.
And because that's what is called, then when I step over it I find that it returns seven to -.
So let us take a look at the API for this.
Just search for MSDN GetDlgItemText and then you will find this article.
Now I'm interested in the return value because that is what is stored in -.
So let's scroll down and take a look at the return value.
If the function succeeds, the return value specifies the number of characters copied.
Okay, so we got it.
So if we find that the number is seven, that means it has copied something from one of this text
box, which is seven characters long, and "cracker" is seven characters long.
That's why - is seven.
So this GetDlgItemText here reads in "cracker," reads this string that you entered for the name and
stores it somewhere.
Okay.
And then next one, let's call this now.
So we call this and it returns zero.
We don't know what that is.
We just ignore it for now.
And then we continue to step over.
And now it's going to call -.
And what is in -?
GetDlgItemText.
So this is the second time it's calling GetDlgItemText.
Let's step over it now and see what happens.
And it returns nine.
So this time the number of characters that it has read in is nine, which means it probably read in
the serial.
It has nine characters in the serial.
So I put a comment here: GetDlgItemText, comma, - nine.
So now we can more or less guess quite accurately that this first call for GetDlgItemText reads
in your name, and the second time it calls it, it reads in your serial.
Okay, let's continue to step over.
Now it's going to compare something, - and also the first byte of -.
So - contains the hex 31, which is the character one.
And the character one is the first character of our serial that we entered.
- is the first byte of -.
So - is 31, which is hex for the character one, and one is the first character for our serial.
And what is it comparing
to? Is comparing to the first byte of -.
Now - contains this string.
The first byte is a dash, a dash.
You can see that it's a dash.
So this suggests that this is the first character of the actual serial.
Now, because it did not enter the character zero, therefore it is probably going to fail and jump.
Not equal will jump.
We can tick on that.
See?
Jump is taken, right?
So when jump is taken, it's going to come here and then it is going to come here.
All right.
Let's see what happens.
Now before we go there, let's take a look at what it is comparing.
It is comparing this first character, -, which is one of the characters we entered with the first byte,
the first character of -, which is dash.
So this highly suggests that this whole string is the actual serial.
And I bet that there will be a loop somewhere which loops through comparing byte by byte, one
by one.
So let's assume that this is the serial.
So let's copy this down.
Open the notepad.
So we type -1632
858569476.
Six and nine, four, seven. Okay.
So let's compare that.
Make sure you got it right.
-1
63285856947.
All right, so we open another copy of this here.
Double-click on this and we begin: "cracker."
And we paste in this one and see whether it is actually the serial.
Click check.
And yes, so our guess was correct.
This is the actual serial.
So we have managed to fish out the serial.
So for this name, the serial is negative and so on, like this.
So every
time you change the name, the serial will change.
Okay.
So now the next trick is: how do we make a keygen, a keygen out of this program?
So for that, we will continue in the next lesson.
I'll see you in the next one.