New 2 Cracking
~~~~~~~~~~~~~~

Tutorial Type  : Tutorial
Tutorial Topic : Fisrt Target, Kwazy Webbit's crackme
Utilities      : W32Dasm
Music          : I dont think we should hear music on this one..
Written by     : ParaBytes
Date           : Dec. 8th, 2001.
Remarks        : get the crackme from this URL : http://its.mine.nu/html/re/resources/FirstTarget.zip

Lets start !
~~~~~~~~~~~~

ok, we have the crackme, now lets start by checking what we have there...
enter some serial like "12345" or whatever...

hmmm, no breakpoint yet, what the heck ????

lets start it in w32dasm...

open up the String Reference Dialog, look for the string we had,
ok, we see the :

* Reference by (U)ncoditional or (C)onditional Jump at Address:
|:0040131A(C)

that means that from that address (0040131A) the code came here,
lets scroll up to this address...

ohh my, so many strings saying what we've failed in...

hey ! whats that ???

* Possible StringData Ref from Data Obj ->"Congratulations!"

:004012AF 68A3B04000             push 0040309B

here you have another string that says we aer good, but what we have above ?

* Reference To: KERNEL32.lstrcmpA, Ord:02D6h

that means that 2 strings are compared...

lets clear things about lstrcmp :
[--------------------- API Explain ---------------------]
  
 The  lstrcmp  function compares two character strings. The comparison is case sensitive.  
  
 int lstrcmp( 
  
     LPCTSTR    lpString1 ,    	 // address of first string     
     LPCTSTR    lpString2      	 // address of second string     
    );    	    
 
  
 Return Value :
  
  if lpString1 < lpString2 then return < 0
  if lpString1 > lpString2 then return > 0
  if lpString1 = lpString2 then return = 0 

[------------------------- END --------------------------]

so, what we see right above that call :


* Reference To: USER32.GetWindowTextA, Ord:015Bh

:0040128D E894030000       Call 00401626       <---- getting our serial
:00401292 0BC0             or eax,eax          <---- serial length = 0
:00201294 0F84AE000000     je 00401348         <---- if so, go away

* Possible StringData Ref from Data Obj ->"Are you Kwazy?!"

:0040129A 6889334000       push 00403389      <----- push lpString1 ("Are you Kwazy?!")
:0040129F 6886304000       push 00403086      <----- push lpString2 (our serial)

* Reference To: KERNEL32.lstrcmpA, Ord:02D6h

:004012A4 E8E9030000       Call 00401692      <----- compares the lpStrings
:004012A9 0BC0             or eax,eax         <----- return = 0 ?
:004012AB 7519             jne 004012C6       <----- if no, go away
:004012AD 6A00             push 00000000      <----- if yes, prepare the MessageBox


ok, what can we see there ??
that the serial is "Are you Kwazy?!" (without the "")

try it, ohhhhh yes !


now, what have done here ?
cracking Hard-Coded String... =]
wasnt it fun ?

 Greetingz :
+-+-+-=-+-+-+

Kwazy Webbit, for his great site, and he non-subjective point-of-view
New2Cracking people (Invoker, Anvile, DarkMoon, ChibiHime, d4d0, PhANt0m)
DR,iNSiGHT,EMBRACE,ExEcution,
tKC, krobar, the rest of the people who publish my tutorials,
YOU !
Bob Marley, he is l33t ! (the reggae'mon of course!)
GodsJiva,comrade,ThE-SAiNT,sinny,Dawai,GogaMoga,Crudd,DnNuke, hmmm...
i think that this greetingz list is longer then the tut itself =]

so, that all...

Contact me :
~~~~~~~~~~~~

Email : Lewsers@Hotmail.com
IRC   : EFnet / #New2Cracking
Here ! ;)

ParaBytes, Lewser 4 Life !