Welcome back.
In the previous lesson, we already fished out the key and we already analyzed the algorithm.
And now in this lesson we are going to do a self-keygen by reusing the same code from this keygen itself.
So let's see where we can use printf to show the self-keygen, to show the key.
Now in the previous lesson we know that when it came to this line here, it compares between what you
enter and whether or not it is same as the number of characters.
Let me rerun that and refresh your memory.
So let's run it now and it hits our main breakpoint.
Let me move this to the right so you can see the output.
Right-click, go to graph, and then keep on stepping over.
Let it load all the strings into the memory.
Continue stepping over.
And now it's coming here.
And if you remember correctly, here is where it does the animation to print out the title.
So we want to skip that and go straight to here.
So enable this breakpoint. It's already been enabled there.
So just run to this breakpoint and animation done.
So now let's step over until it comes to the input for the registration name.
And now it's waiting for you.
Type "crackers", enter.
And now it's back here in control.
Step over.
And here it calls the string length.
It prints the number of characters for "crackers", which is eight.
Then it will now double it to become 16.
And then it's going to save that 16 into - minus 9C.
Continue to step over.
Now it prints "registration code" and then continue stepping over.
And now it waits for you to enter your registration code.
Assuming we don't know the registration code, we just type one, two, three, four, five, six, hit enter, and
now it comes back to our control.
We continue stepping over it.
And here is where it is going to load the 16 which is stored in here. Earlier on it stored here, 16.
So now it's going to load it back into -.
Okay.
As you can see now, it loads 16 back into - and then step over, it doubles it to become 32.
So now it's going to compare whether or not the value that you entered, - minus 9C...
This is what you entered. - minus 9C is 123456.
This is the hex for 123,456 and this - is 32.
So by the time it reaches this line, it already knows what the actual key should be.
So it is good.
From here onwards we want to, instead of printing the regular output, we want it to print the key out
here.
So to print the key out here we can make use of the printf function.
So the printf function takes two arguments.
The first argument is the actual value you want to print.
And the second argument is the format specifier.
In C programming, the printf function accepts two parameters.
Here is one example.
Uh.
The C function accepts the format specifier and it also accepts the value.
So the format specifier can be %d for integer or %s for string, and so on.
So in this case we are interested in printing an integer.
So we should use %d as the format specifier.
So over here in our notes, this is the integer value.
And this is the format specifier.
So what we want to do is actually like this: printf, if it was C you are actually going to do this.
And then here will be your - value.
This is what we want to do.
So the first parameter is your format specifier.
And the second parameter is your -.
So how do we implement this in assembly language?
We must push - first and then push the format specifier and then call the printf function.
So if you forgot about this you can just Google "printf function in C" and you can read all about it.
So the second parameter is pushed to the stack first as push -.
Then the first parameter is pushed next, which is your format specifier.
And finally you call the function printf.
So now this part of memory is where we have to put our string, our format specifier.
So we have to hunt for the location in memory which is available for us to put our string.
Then we can push the address of that string to the stack. To get this free memory,
all you need to do is go to Memory Map and look at the data section for your program.
Since "keygen me" is our program, look for the data section.
Don't use the data section from the reserved here or kernel or other places.
Look for the one for your program.
Double-click on that.
And down here you can scroll and look for an empty space.
For example, the one I'm using is 403F1B0, it's all blank.
So I can use this.
So I select two dwords, one dword, two dwords.
So that is long enough for my string.
This string here that I want to put in.
So I right-click here, go up to Binary Edit.
And then from here in ASCII, backspace to the left corner and type "key colon %d".
Then I click okay.
So now I've got my string in memory.
I can now push this to the stack over here: 403F1B0, 403F1B0.
Yes.
So copy this here.
And then next one is to look for a printf function that you can use.
So over here let's hunt for a printf function.
All right.
It's easier to go back to disassembly view.
Press G to go back to this disassembly view.
Or you just click "follow in disassembler" and look for any function, for example this one.
Right.
And you want to know what is the address of this printf.
Just select it, press the space bar and you will see the address.
So just copy this whole thing here including the address.
Click cancel and then paste it here.
That is the address of your printf function.
So now we've got that, we are ready to assemble
these three lines, insert these three lines from here onwards.
Now to do that we can go directly here and do our first one which is push -, press spacebar and type
in push -.
Okay, okay.
Then the next one is here which is push your format specifier.
So copy this and put it here and paste.
Click okay.
And the next one will be call your printf function.
So copy that and put it in here and click okay.
All right.
Next we have to tidy up the rest of the code.
Because after this printf it's going to fall through and do all these things here which we don't want
it to do.
So since we don't want it to do all these things here, we can just NOP them.
You can select all these, all the way until maybe, maybe here, until this printf here.
Then the rest should be harmless.
So all this we just right-click and NOP.
So we NOP that. That means after it finishes pushing this value for - to the stack and pushing the format
specifier to the stack, it will call our printf function, which we created.
Then it will NOP everything over here, everything all the way until here.
And then do all these things here and then eventually quit.
All right.
So should be quite safe now.
And we can assemble it. File, patch file.
And then let's give a name with a dash E extension at the back. Dash...
dash two.
Sorry.
Dash two for patch two. Click save.
Okay.
So now we are ready to test it.
So let's go and get the path for this.
Select the path for this program, and then right-click, copy this path.
We are going to go there in the command prompt.
So come down to the bottom, right-click, search for the command prompt.
You can type "cmd" down here to search.
Or if it's there you just click it. Type "cd" to change directory.
Enter a space, right-click to paste your path.
Press enter, type "dir" and you should see the file that you want to execute, your second, your patch.
So you want to execute this.
Just type "syn", S-Y-N, the first few characters of the name of the file, and press the tab key a few times
until you see the right one.
Once you got it, just press enter and it will run.
So enter "crackers". Hit enter. Registration code.
Just press anything.
It doesn't matter what.
Press enter and you get "key is 32".
So this "key 32" is coming from here.
It prints "key colon" as you can see, "key colon".
And then %d is the format specifier.
It substitutes the value of - in that.
So it is 32.
So this - value is actually two zero in hex.
But because your format specifier is %d it converts the hex value into decimal number which
is 32.
That means now your self-keygen is working.
So "crackers".
If your registration name is "crackers" your key is 32.
Okay.
We can test it out to see if it's working.
Open your...
another version of it here.
Open this one or take the original copy and run.
And now we type in "crackers".
Type in 32.
Hit enter and you see it's working. 32.
Yes.
Correct.
Now let's try another one.
What if... let's run our... let's run our keygen again.
This time we enter a different name.
Maybe we enter, "apple of the eye".
Hit enter. Registration code.
Just type anything.
All right.
So "apple of the eye", registration name.
The key is 52.
So let's try it here.
Run the original.
Type "apple of the eye", "of the eye".
Registration code 52.
Enter.
Yes, it works.
So our self-keygen is working.
So this is how we can use the data section of the memory in conjunction with your printf.
So the data segment is to put in your format specifier.
And then once you got that in, you can just find any part in your code section and
inject your three codes here: one, two and three, and NOP whatever the rest you don't need.
So that's it.
So that's all for this lesson.
Thank you for watching.