NewBies Simple KeyGenMe

From UIC

Simple KeygenMe

NewBies Simple KeyGenMe
Author:	Zyrel
Email:	marcolagalla@yahoo.it
Website:	Unfair-Gamers
Date:	10/01/2011 (dd/mm/yyyy)
Level:
Language:	English
Comments:	Really simple, suitable for newbies.

Introduction

Directly from UIC's glossary the definition of KeygenMe:

« Programs written specifically to be cracked / reversed. Typically the only feature of crackme is its protection, which may take as a model existing protections (such as commercial programs), or more frequently offer something new and original.».

In this particular case we're not going to crack the program (or we'll do it just for completeness, but is not our goal) but instead we're going to "sniff" the code in order to deduce the algorithm that generates the correct serial.

Notice: there is an italian version of this tutorial.

Tools & Files

• OllyDbg v1.10

URL or FTP program

For the occasion we're going to use a small program created by me: KeygenMe#1

Essay

Well, now I assume that you at least know the basics of assembly and at least one programming language (to create the keygen).

Ok, now start the tutorial itself, start the program just to have an idea of how it works:

Well what we see?

 • 1^ Textbox: not editable and shows us a number (integer).
 • 2^ Textbox: in which we are asked to enter our serial.
 • Button: used to check the serial.

There is no request for a nick or otherwise, then it seems logical to assume that the algorithm that generates the serial based on precisely that issue, well now we ask:Why just that number?(67 in the screen) , here is if you try to reopen the program you will find another number, always an integer, but each time different.

Perfect load the target (I'll often call in this way the KeygenMe for the rest of the tutorial) in Olly and let's stop to take a look at the code:

This is the entrypoint of the program, but this part does not concern us, rather shaken down:

 • Here we see a call to CreateWindowExA:

 • Here we find an interesting part, with two calls, at rand() and srand()

Well here we understand how the number that is generated (as I anticipated) the algorithm is based. Then we deduce that uses the srand () and rand () using as seed the first time () function, there is a call to rand () again below but we are not interested.

Run with F9 and try to enter a serial at random, I will use the good old 1234567890 ;) There appears a messagebox that warns us that the serial is not correct, Well I think that the program can be done more or less like this:

Well then do not waste time ;) Topping up your target on Olly pressing CTRL + F2 and Commandline type:

 N.B. who did not have the plugin CmdLine can find it   here.

In this way we placed a bp (BreakPoint) on all calls to that API (attention to character cases, the cmdline is case-sensitive), now re run pressing F9 and add with our fictitious serial (for me 1234567890), just before the MsgBox appears to tell us that our serial is wrong with the debugger break us here:

If you look just above you will see:

I commented the code in the important points, but the thing that interests us most at the moment is that:

Now we open a small bracket:

The Cracking

I believe that you have already guessed, but if we reverse that jump we make that if a serial was the wrong targets would appear to confirm the MsgBox (You want to try? try to set the zero flag to 1, you will see that not make the leap and you will see just MsgBox) I will not dwell much because it is not our purpose to go straight to answer:

   •First method: replace jnz (Jump if Not Zero) with a JE (Jump if Equal)
   •Second method: jnz replaced with a JMP or a jump to incodizionato 0040178F, MsgBox Confirmation
   •Third method: noppare all doing well up the MsgBox

Frankly, I prefer the first method, then we go for a small patch of just having one byte as follows:

In fact, in the box below:

Now to make the changes permanent you go read the tutorial on how to do manual patching or for the first (if you already know how to do it manually)Right click-> Copy to executables-> All Modifications-> Save.

Identification and study of the algorithm:

Now we enter the real part of our tutorial: analysis of the algorithm. We left here:

If even more shaken up, just below theGetDlgItemInt you will find this CALL:

Hmm...a call in the function that reads the value (number) of the textbox... close to the conditional jump...Well I would say that it may be interesting, so we place a CALL bp with the F2 and run entering the serial, stop us on the CALL, pressing F7 we step into the CALL and we brought up a routine that, I play my slippers is that the generation of the serial:

As you can see does nothing more than to do some simple calculations with the value in EAX, which is precisely the number random by the program shown in the textbox disabled. In fact, the value returned by an API is always contained in EAX (from GetDlgItemInt). For further proof typedin EAX and you will see that CmdLine contains precisely that number.

I would say that the code is clear, however, Let's see the basic traits:

That translated into pseudo-code would be:

So the deliver that generates the serial is:(EAX ^ 5) + Eax where eax is the random number. But here lies the only difficulty with this pseudo crackme, the result of calculations is treated as and when dword eax is greater than 84 (which happens often) then Eax exceeds 0xFFFFFFFF ^ 5, which generates overflow errors that make it invalid in the eyes the program even if the serial potentially correct.

A keygen is precisely follow the calculations made by the program, then: Eax * Eax * Eax *(Eax ^ 2) + Eax and thus avoid an overflow, even more correctly the most appropriate solution would be:serial = ((Eax ^ 5) and & HFFFFFFFF + Eax) and & HFFFFFFFFwith two logical And.

The KeyGen

Finally our beloved keygens ;) I will present it in two languages: C + + and ASM.

Asm:

Endnotes

And so we come the end of my first suits up Quequero:) Well I hope to be able to write everything clearly and not too Pallos for any questions or concerns you can contact me via mail, via the bore of the UIC pm on UG, wherever you like:)

A special thanks to Evolution for the source in ASM Keygen (which resolved in 40 seconds flat xd) and for some clarifications. Zyrel.

Disclaimer