Hello and welcome back.
In this lesson, we will take a look at another crack.
Me, uh, this one is called Sports Stars.
Bobby.
And the password to unzip it is crackinglessons.com.
Inside it, you will find this file.
I created additional, uh, notes here for writing the notes as we observe the behavior.
The download link is originally from here.
So this one is, uh, a 64-bit program.
Let me take this and scan it with DIE.
If you see, it's 64-bit, written in Visual Studio 2022.
So let me just run this and see what it does.
So I just opened a command prompt here.
And run it.
So you see, it prompts this.
Uh, hello?
I'm Bobby. Can you hear me, please?
And then enter the name of medicine for Bobby.
So you don't know what it is.
You just type in anything and enter.
And it says this is bad medicine for Bobby.
So the strings we are going to search for, uh, is actually all this. Later on, we need to search
for these strings.
Yes.
And later on, you will find that, uh, this program uses encryption.
And first, I will try to show you what it does, and then I will try to show you how to bypass the encryption.
You don't need to go and decrypt it.
Okay.
So now let's take a look at this inside x64dbg by searching for this string.
This is bad medicine for Bobby.
So you can open it with x64dbg.
Please, on the right.
So right-click here and search for current module,
string references.
And here you can see this is bad medicine for Bobby.
So you double-click and go to that location.
I can now close the original one here.
And here, if you expand this to see, the string is shown in the comments column.
This is bad medicine for Bobby, and here is a good message: Thanks.
Bobby is now cured.
Then if you scroll further, you see all kinds of, uh, comparisons have been done and the conditional
move as well.
And then jump not equal.
And you go further.
And you see so many shift rights happening here.
So these are all the encryption happening.
And then here is the start of the program, where it prompts you to enter the name of medicine for Bobby.
And here is the start of the function.
After all this initialization,
so maybe here you can put a comment: main.
And then here you can put a breakpoint.
I've just pressed G to go into graph mode, graphical mode.
You put a breakpoint here, then you run.
And now you analyze the output.
You turn tracing, trace coverage word, and step over.
And watch the output.
You can see the animation,
uh, the graphics appearing as you go down.
And then it's going to come to this line.
This call will print this prompt, and the prompt is there.
Continue to step over until this becomes into a running state.
Now you're in your running state.
So it's waiting for you to enter something over here.
So at this point here, you can put a breakpoint over here.
And
power on Bitcoin, and then, uh,
okay.
So enter anything you want.
123456789,
let's say.
Hit enter.
And you are now over here.
Continue stepping over.
And this is your first compare: it's comparing 30 with 10.
And it's a loop, as you can see, it's going up in a loop.
So continue stepping over.
So it goes back up.
It compares 30 with 10 just now.
So it's going to loop three times.
Each time it loops, it increases by 10.
So if - is not 30, it will go up and loop again.
That is the meaning of jump less than.
So it will loop three times.
Then it comes up.
Here's another loop.
You can see it's going back in the back.
This time it's going to loop seven, eight times because the - is using it as a counter.
So each time we come past this area with, uh, eight...
So this hex is interpreted as eight in, uh, as a string character.
So now it's comparing it's five.
Nine, six.
And then seven.
And then when it finishes, it's going to quit the loop.
Now over here is where it compares.
It shifts the...
Listen, uh, registers shift.
Right?
But the amount of the shift is coming from the - and - here shows that it is one, one.
So at this point here, here is one.
But as you go down, you notice the parameter changes to two.
Let's go down. Exam three.
- is three now.
So this seems like it's taking from your input.
Your input is 123456789.
That's why - keeps increasing according to your input.
Lower.
- has now four, which is
the fourth, fourth character you entered.
It is taking whatever you entered here and shifting it by that amount over the string.
So this, this, this location here contains several, uh, bytes of information.
You can go there, select this, right-click, follow in dump, and then follow this address down, so you
can see this address. Four is this.
And then nine five is this one.
And nine six, this one.
And nine seven is this one.
So it's taking your input and doing a shift right operation on all of this, all of this, uh, fixed
uh, data.
So you can see happening now is this 97, 97 is here.
So it's going to change this value to something else by shifting it right with the parameter -, which
is two, which is four.
So take a look at this.
Now as it happens, this four becomes zero.
And so on.
Now it's taking nine eight, which is this.
This is nine.
Eight is going to perform shift
right.
Uh, -, - is five, which is your fifth input here.
Shift right to change this, shift this right by this amount of bits.
So it's going to do that.
What happens?
It becomes zero.
So you keep doing this using your input, right?
So this is what it means by encryption.
It takes your input, encrypts it, and saves it somewhere.
That's what it's doing.
So let's quickly run through all this.
It's performing all the encryption.
It's calling a function,
calling another function.
We are only interested in the compares.
All right.
This is a compare.
It is now comparing - with this zero. Zero comes from here.
Right? This compare,
it will affect this.
Remove conditional move.
So this conditional move is based on this compare.
So CMOVE,
that means if this comparison is true, that means if whatever is inside here is same as whatever is in
-, then this will be true.
Then it will move to -.
That's the meaning of CMOVE equal.
So C equal.
So if, if this is equal,
if this CMOVE,
if these two is equal, the zero flag will be set.
So it will check the zero flag. Since it is equal,
so it will move - to - like that.
So if you notice, it says - now is -. - is here.
If - is here, notice that one will be moved into here after this instruction.
And there you go.
One is there. Another compare is comparing one with 20.
So in this case, it is not same.
Therefore, this jump will happen because there are, because the value in - is not the same as the value
here.
So it will jump.
It will skip this part.
We can say that it is expecting these two values to be the same.
Right.
It wants these two variables to be the same.
So because they are not the same, it means that our password somehow is wrong.
That's why it's going to jump.
So we just
continue.
Then another compare.
Now it's comparing one with...
We are comparing one with zero.
Again, they are not the same.
So it's expecting these two values to be the same, either one one or zero zero.
But in this case, they are not the same.
They are not the same.
So this will affect this instruction because this instruction depends on this compare. If they are the
same,
if these two values are the same, then zero flag will be set, and then zero flag will be set.
This won't jump.
Uh, then this instruction won't happen because this instruction means CMOVE not equal.
That means if these two is not equal, then it will move - to -.
Understand? If they are not equal.
But if these two are equal, then we will not move - to -.
Uh, if these two are not equal, then, then it will move - to -.
But if these two are equal, it will not move this to -.
So that's the meaning.
So in other words, it is expecting these two to be equal.
So in this case, uh, because these two are not equal, zero flag is not set.
Therefore, it will move - to -.
You can see happening here.
If - will move to -, that means one will be moved into here.
Step over, and you can see that indeed one is moving to here.
So this is bad.
All right.
Something has gone wrong here.
So another comparison is here.
It compares, uh, this one with zero.
Again, this comparison fails.
That means again something is wrong.
If these two should be the same, it is expecting these two to be the same.
But because they are not the same, this move will happen.
- will move to -, right?
Again,
because why? Because CMOVE not equal.
So it will go here.
You will see that happening. - will remove it because zero flag is not set.
Because this is not equal, zero flag will only be set, uh, if these two is equal. Because these two
is not equal, zero flag is not set.
Therefore, this move not equal will happen.
So - will move to... Take a look. - will move to -.
That means one will be moved into here.
And there you go. One is we move there.
Another comparison.
It expects these two to be the same.
But if you compare, you can see that they are not the same.
You are comparing one with zero. Again, something has gone wrong.
So this will become jump not
equal will happen, which is a bad thing.
So it's going to jump over this.
So it jumps over this, right?
Again.
So the principle in, uh, this, uh, reverse engineering is to look at all the compares.
If the, the compare is effectively saying that it wants these two, whatever they are comparing, it
wants it to be the same.
That's why it's comparing.
If they are not the same, that means that something has gone wrong and the jump will happen because
the jump is always based on the comparison.
Okay.
All right.
So that's, that's what we are doing here.
Uh, it will not jump because this is the same, uh, this, in this case, is the same.
So you know it won't jump.
Okay.
Now it's comparing.
So they are the same.
So that's a good thing.
It's a good thing.
So this move will not happen because these two are the same.
Zero flag is set.
And you can go on and on like that, okay?
You just compare, you analyze and comparison, and then you predict a move or no move.
You analyze the comparison and then you predict whether it moves or not.
You analyze the comparison and you predict the move.
So keep on repeating whatever we have...
I've just showed you.
So it comes to here.
So this comparison, we find that they are the same.
So it's a good thing.
You go straight, and here again, you repeat the comparison.
So I'm going to go a little bit faster.
Until we see something bad happening here.
Okay.
Something interesting coming up.
You see this two?
This is bad medicine for Bobby.
Bobby is now...
Now, this comparison here will determine whether or not this move will happen.
The - and - are...
- is here.
So I see what happening now is comparing this.
Whether it is 1E.
So it is not 1E, it is 1C.
So because it is, it is not 1E,
therefore this move happened.
Take a look at that.
You move - to -.
- has got this good message.
- has got a bad message.
So it's going to move the bad message to -.
That means there will be two bad messages.
So this is definitely bad, right?
Because this comparison failed, that's why it is moving the bad message into the good message and overwriting
it.
And after it does that, we are going to call, and watch what happens in the output.
The bad message shows. He got it.
So this is a hint for you.
We can break the entire encryption just by doing something around here.
We don't need to go and analyze the encryption and try to decrypt it.
That is not necessary.
So for that, we will continue in the next lesson.
Thank you for watching.