Hello and welcome back.
We are now going to try this new game from this author, so I've already downloaded this for you.
Go and get your copy from the resource section for this lecture.
After you have downloaded it, unzip it using the password cracking lessons.com.
Make a copy of the original files so that you have a backup, and then scan this. If detected,
easy.
I've already done that and I found that it is a 32-bit program.
So now let's analyze it by running it and see what it does.
So you see there's an animation there for the title.
And then it asks for the registration name.
I'm going to key in "crackers".
I hit enter.
Then it asks for the registration code.
So I'm going to key in one, two, three, four, five, six and hit enter.
And it says "try again".
So this keygen me takes your registration name.
And then from there it creates a registration code based on your registration name.
So the purpose, the objective of this project is to first do fishing to fish out the registration
code.
And then after that in the next lesson we will be doing the keygen itself.
So there are two objectives here.
So now since we have already understood the behavior, we should now start to do the first part, which
is to do fishing.
So to do fishing we will open this program and search for this string.
So we open it in x64dbg.
32-bit.
I'm just going to reload it since I've done it before.
And search for this string.
"Try again".
So right-click here and then go down to search for current module string references.
And you should find a long list of strings.
And so we're going to filter out "try again", "try again".
And there you have it.
"Try again".
So double-click on that to go to the address for that string.
And try to scroll up to look for the push -, which marks the start of this function.
So there it is.
So I put the comment "main".
So I'm now going to put a breakpoint there by right-clicking breakpoint toggle.
Then I'm going to turn tracing on, trace, trace coverage word.
And then I'm going to right-click and graph it.
Now I'm going to run it and let it hit our breakpoint, which it has done.
Then I'm going to adjust this thing to go to the right.
Let me close the other windows as well.
I'm going to get the windows off.
And so adjust this so I can see everything.
And then I'm going to step over, step over, and step over for the ones that...
So now it's loading the strings that are going to be used in the program.
As you can see, all these are coming from the data segment.
This is data segment which is referring to here, the data segment.
So the data segment contains all the initialized strings which are used by the program.
So you can see all the strings which are being loaded.
They are going to be used in this program.
So these steps, all this, they are not so important.
Okay.
So here it's doing some comparison.
Again, not important because we have not input anything yet.
So the comparison is unimportant.
Continue to step over and it has jumped to here.
Continue to step over and now continue to step over.
All right.
So now it's going to enter a kind of loop.
So let's see what happens when it goes into the loop.
And watch the output here.
W has been printed out.
If you continue to loop, it will print all the rest of the animation for the title.
As you can see now, it's printing E and if you keep on looping, it will print the rest of the string
one by one, character by character as you keep on looping.
As you can see, L is coming out now, C, followed by O, and then followed by
M and so on.
So from here you can see that the loop starts here, comes here, and then loops back into here again.
So you keep on looping.
And from the observation we can tell that it is a loop which is actually doing the animation for the
title.
So we are not interested in that.
We want to exit the loop.
To exit the loop quickly,
we put a breakpoint here because this is where the loop checks whether it has satisfied the counter.
So in this case, we are going to exit the loop by putting a breakpoint here, right-click, breakpoint
toggle, and just run to your breakpoint to exit the loop.
And as it prints the rest of the string, it completes the loop.
And it comes back out here.
So this is what interests us.
So now let's continue stepping over and observe the output here and see what happens. Okay.
Now it's going to call a printf function.
And it prints "registration name".
It is still in a paused state.
It is not waiting for input.
So continue to step over line by line, and after this call it will wait for your input.
Notice I put comments here and you should do the same so that it's easy to read.
So step over now and notice what happens.
It goes into the running state.
This means it is waiting for input.
So now let's put the registration name.
"Crackers".
Crackers, crackers and hit enter.
Once you hit enter, the control comes back to the debugger.
As you can see now, it's in the paused state and is waiting for you to step over.
So let's continue to step over it now, line by line again.
And now it's going to call a string length and step over it and see what happens to -.
Every function returns the result of the call inside -.
So we are interested to see what is going to be the value here.
So let's step over and see.
And -, eight.
So eight.
If you notice, eight and the number of characters in "crackers" is the same. "Crackers" has got eight characters.
So string length appears to be counting
how many characters are there in your registration name.
So that is what it does.
And it returns eight here.
So I put a comment there "- equals eight".
All right.
So let's continue and notice now what happens. It's add -, -.
So it increases eight.
So step over, - becomes 16.
This is hex for 16, one zero is 16.
So continue to step over and it saves your 16 into - minus 9C.
So - minus 9C stores the length of your string times two.
So that is what - minus 9C is storing.
So let's continue now.
Continue to step over and it's going to call printf again.
And now it prints "registration code".
So I put a comment here "shows registration code".
Continue stepping over.
And after this call, see what happens.
It goes into a running state.
That means it is waiting for you to input.
So I put a comment there as well.
"Waits for registration code input".
So let's type anything: 123456, hit enter, and now control comes back to the debugger.
As you can see, it's back to the paused state, waiting for you to step over.
Continue stepping over line by line.
And now it is moving
- minus 9C to -.
Now remember, - minus 9C contains the length of your registration name times two, and it has stored it
here.
Now it's recalling it back into -.
Step over and you see now - stores the value one zero, which is hex for 16.
It will now add - to -.
That means it's going to double it.
It becomes two zero, which means 32.
So from 16 it becomes 32.
Originally it was eight.
It was eight.
And then it doubles it, it becomes 16.
And then here it doubles it again to become 32.
So now it's going to compare this 32 with whatever is in - minus 9C.
Look at it here. - is 32.
This is hex for 32.
And this is hex for whatever is in - minus 9C.
So let's take a look.
What is this value in decimal? 1E240.
Oh, I'll use the calculator here.
And then key in 1E240. One is in the hex column, in the hex text box.
1E240, 1E240
is 123456
in decimal, which is your input. That means it is comparing your input whether it is 32.
So this suggests that the registration code is 32.
So this is how we can fish out the code.
So for "crackers", the registration code is 32.
Very simple fishing. Okay.
So we know that we can test our hypothesis.
We can go here and run another copy of this program.
And then key in "crackers" and key in 32 and see what happens.
Correct?
Correct.
We have fished out the code.
We have fished out the key.
So for "crackers", the registration code is 32.
That means the algorithm is very simple.
All it does is it counts the number of characters in your input for the registration name and then doubles
it two times.
So if your registration name has got eight characters, it doubles it to become... eight to become 16,
and doubles it again to become 32.
All right.
So that is the algorithm.
So if your input is seven characters, then your registration code should be seven
plus seven, 14, 14 plus 14.
It should be 28.
All right, let's try our hypothesis.
So supposing we now run again.
This time we enter a seven-character registration name.
And the registration code should be seven plus seven is 14, 14 plus 14 is 28.
So let's try 28. Correct?
Correct.
So we have already derived, fished out the algorithm for this
keygen.
For this simple keygen me.
All right.
So now that we have solved this, in the next video we are going to create a keygen for this,
this program.
And we are going to make use of the code itself to reveal the... to reveal the key.
That means we are going to create a self-keygen.
Now in this section we are going to use printf, which is already there for us to use.
As you can see, it is using printf quite liberally. Printf over here.
And it's got printf here and it's got so many printfs that we can tap into and show our actual
key.
So with that, I'll see you in the next lesson where we will do our self-keygen.
Again.
Thank you for watching.