Welcome back.
In the previous lesson, we already managed to fish out the serial.
Now we are going to create a keygen itself.
Keygen.
So over here we know that this is the place where it's comparing.
It's comparing the first character, first character of your input which is -, which is your first character.
Here one, - is the first character, a first byte of your input, which is one, and comparing it with
the first byte of -.
How you know it's a first byte because it says here byte, byte pointer.
So it's comparing that with comparing your one with -, the first byte negative one.
And we correctly guess that this whole thing is a serial.
So we don't have to do loop tracing anymore because we copy this and paste it inside,
and it worked. Okay.
So now how do you make a self keygen? To make a self keygen,
we need to have a message box that we can use.
So the only message box that we have is this one over here.
But this message box will only show a congrats message.
It will only show congrats message.
And the congrats message will only be shown if you have entered the correct serial in the first place.
So somehow we have to force this congrats message to show even though we entered the wrong serial.
Okay, so that's the first step.
So to do that we will have to first study where it goes to the trace.
We will trace it now.
So after you entered that it comes over here and over here you will see it's going to do something to
-.
So let's step over. - now becomes zero and then step over again.
Now this one makes - become one.
First it was zero.
Now this one makes it become one.
And then next it goes over here and it tests for -.
And we find that - is not zero.
So because - not zero, jump is taken. That means it's going to jump over the congrats message box.
So in order to make it not jump we have to make sure - is one.
Now in order to make - one we have to nop this because it is this line which turns - to become one.
So let's try that again.
Let's run it now. Let's click check.
And we are now here.
Let's continue to trace.
And then let it go to here.
Okay.
Now at this point, - is. We're going to step over this and we see that - is zero.
So we want it to be zero.
We don't want it to become one.
So we have to nop this because it is this which turns it to one as we have seen previously.
So I put a comment there to remind ourselves that we need to nop this.
So let's do that now. Let's right-click on this, follow in assembler.
And over here we just binary fill with NOPs. Click okay.
So now we head back to our code,
our graph view.
And now this one should be nop.
So let's refresh and see.
Refresh.
And we see that it is now NOPs.
Let's continue to step over.
Now you notice that - remains zero.
It doesn't change to one.
So let's continue.
Step over.
And now when we test -, - is zero.
So this jump will not happen.
Jump is not taken.
That means now it will go straight.
It will go straight and it will show the good message.
Let's step over and see that happening.
And the good message is now showing.
Step over.
There you go.
All right.
Now we have nopped this to show a message box which we can now use to show our serial in here.
Right.
So we are going to do two things.
First we are going to show the serial here.
Second, we are going to change the caption to serial, serial.
That's the two things we are going to do.
The first thing is how are we going to change this
to show the serial? Click okay.
Now let's look for the address where the serial is being stored.
Now the serial is being stored at the places where it is comparing, which is here.
Remember, let me step over and show you again.
Click check and then let's run.
And then let's not hit our breakpoint.
Let us now step over until it comes to this line.
Now click on this and you will see
this is where it's comparing the first character of the actual serial with the number, the first character
of our input, which is one, and this is the address.
Let's look for the address of -.
This is the address where the actual serial is being stored.
This the address 417730.
So we need to copy this address out because we are going to use it as a parameter to our message box.
So we copy this line and then put it in here.
And this is the address that we want.
This address contains the entire string that contains the serial actual serial.
So now we are going to put this address.
We copy this first, copy out this address and head over down to our message box over here.
Here we are going to change this address to the one we just copied.
Okay.
So let's step over until we reach there.
All right.
So now we are here.
And this is the second parameter of MessageBox.
If you recall from our previous lesson, the second parameter of the MessageBox is the string that
is going to be shown. Okay.
So we can now assemble this. Right-click, follow in assembler.
And we are now here.
We are here now and we are going to change this address.
So press spacebar and paste the address that you have copied.
So this address has copied contains the string of the actual serial key: 417730.
Click okay.
Make sure you check on this keep size. Okay.
And now we go back to our,
go back to our graph
view.
And refresh.
And let's see. Okay.
So now it's changed to the actual serial key.
Sorry.
Not there.
Here.
See that it's still showing the congratulatory message?
Now it's showing the serial key.
So let's step over it and see
it happening.
Step over.
The call is going to call the message box now.
And let's see what happens.
Step over.
And message box should see
"You did it."
This is the actual serial.
Okay.
So now to test that this is actually serial, to compare to our previous copy.
Negative one 6328.
Negative one 6328569475694.
Correct.
It is the right one.
All right.
Now the next task is to change this caption to serial.
So this caption is the third parameter: 1, 2, 3.
Third parameter of the message box.
Instead of "You did it,"
we are going to change this to serial.
So let's do that now.
So click on this one.
Here we get the address 404200, which is here.
Right-click this, follow in dump, 404200.
And you see this is the string that we want to amend.
So we select all this string up to this, leaving the last dot here which is the null terminator.
We don't need to change that.
And then right-click and then binary edit.
And then here make sure you click on keep size.
Here you just change this to serial. This place it with a space bar.
We've got serial and we need one space bar, 2, 3, 4, 5 more spaces: 1, 2, 3, 4, 5 spaces.
Click okay and refresh.
And we should get it correct this time.
See that?
Serial plus five spaces?
Yes.
And the null terminator at the back.
All right.
So now we can check it again.
Test it out.
Click check, click run, run again.
Now it's here.
Let's step over that.
And we see serial.
All right.
So now we can patch it.
Click patch file.
Close this, click patch file and give it a name: keygen
and then dash one dash SKG for self keygen.
Click save, click okay.
All right.
So now we can test our self keygen.
We can close this program.
And you go to this one and test our self keygen.
Okay.
So this is a keygen.
So now we're going to enter cracker.
And then we are going to put any wrong serial.
Click check and it gives us our keygen, our serial for this user.
And we copy it out here for this user.
This is the serial.
So how are we going to test
that is correct?
We open the original file.
Open the original file.
We key in cracker.
And then we copy this keygen,
this generated serial.
Paste it in here and click check and see.
It works.
All right.
Let's try another one.
Supposing we are going to change it to another user.
So we use our keygen to generate any other user.
Other user. This type "other."
And then any serial, click check.
And this is the serial for this user called "other."
So let's copy that down.
It is
15871587554025554025.
And this is for the user called "other."
So let's test it out.
We open our original keygen, our original crackme here. Key in the username called "other," and we copy
this and paste it in here.
Click check.
Yes.
It works.
All right.
So this is how we can use
a self keygen.
How to create a self keygen even though it doesn't have a message box to show the bad message, you
can still create a self keygen by using the message box that shows the congratulatory good message.
So that's all for this video.
Thank you for watching.