Cruehead/MiB CrackMe v1.0
HOW TO MAKE THE KEYGEN
Written by tnHuAn

Now, run this crackme and click menu: Help/ Register.
You will see a register dialog will 2 textbox, if you want register this crackme,
you must enter your name and correct serial.

I enter my name the fake serial:

Name : tnhuan
Serial : 123456

Now press Ctrl-D to pop up SoftIce, in SoftIce set a breakpoint on GetDlgItemTextA
( Type : Bpx GetDlgItemTextA, then you press Enter).
Press Ctrl-D to return the crackme, and Click ' OK ' , wow.... You are in the SoftIce.


:0040121E  Call USER32!DialogParamA
:00401223  Cmp EAX,00
:00401226  Jz 004011E6
:00401228  Push 0040218E <--- d 0040218E
:0040122D Call 0040137E<---Calculate with your name.
:00401233  Push EAX
:00401238  Push 0040217E
:0040123D Call 004013D8<--- Calculate with your serial.
:00401240  Add Esp,04
:00401241  Cmp Eax, Ebx<--- Compare Eax with Ebx
:00401243  Jz 0040124C<--- If yes then jump to good message
:00401245  Call 00401362<--- Show the Bad Message.

Now, you type : ' d 0040218E ' ,hmm.... you see your name in datawindow.


At the line : 0040122D Call 0040137E , you press F8 to trace into the call,
you will see this code :


:0040137E  Mov ESI , [ESP+04]
:00401382  Push ESI
:00401383  Mov AL, [ESI]
:00401385  Test AL, AL
:00401387  Jz 0040139C
:00401389  Cmp AL, 41<--- Compare Charecter in your name with 'A'
:0040138B Jb 004013AC<---- If < then jump
:0040138D Cmp Al, 5A<---Compare Charecter in your name with 'Z'
:0040138F  JAE 0040139A<---Jump to 0040139A if >=
:00401391  INC ESI <---- Esi=Esi+1
:00401392  Jump 00401383<---- Jump to 00401383
:00401394  Call 004013D2<----- Upcase charecter in your name. Ex : 'a'--->'A'
:00401399  INC ESI<----Esi=Esi+1
:00401394  Jump 00401383<-----Upcase Charecter in your name.
-----------------------------
:0040139C Pop Esi
:0040139D Call 004013C2
:004013A2 Xor Edi,00005678
:004013A8 Mov EAX, EDI

This part of code look like the loop. And This loop will upcase all Charecter in your name.
My name is : ' tnhuan ', after this loop , it will be : ' TNHUAN'.
Then , it get ascii value of charecter in my name, and add all of them.
Ex: ASC(' T ') + ASC(' N ') + ASC(' H ') + ASC(' U ') + ASC(' A ') + ASC(' N ')
Then it change the result to Hex , and Xor with 5678h.

Now , return the main code of this crackme, and use F8 to trace into the Call at the line:

:00401238 Call 004013D8

After press F8 , you will see this code:

:004013D8 Xor Eax, Eax
:004013DA Xor Edi, Edi
:004013DC Xor Ebx, Ebx
:004013DE Mov Esi, [Esp+04]
:004013E2  Mov Al, 0A
:004013E4  Mov Dl, [Esi]
:004013E6  Test Bl, Bl
:004013E8  Jz 004013F5
:004013EA Sub Bl, 30
:004013ED IMUL Edi, Eax
:004013F0  Add Edi, Eax
:004013F2  Inc Esi
:004013F3  Jump 004013E2
:004013F5  Xor Edi, 00001234
:004013F8  Mov Ebx, Edi

Look this part of code , I think it is a loop, and this loop will change your serial to Hex.
Then, it Xor with 1234h.
And EBX= Result

Ok, to Register this crackme, you must make EAX=EBX.
How to make it? You must calculate a serial which make EAX=EBX.
Now, I will calculate the correct serial for my name.
My name is : tnhuan. And the Calculation:
ASC(' T ') + ASC(' N ') + ASC(' H ') + ASC(' U ') + ASC(' A ') + ASC(' N ') = 462
Hex(462) = 1CEh
1CEh Xor 5678h = 57B6h
57B6h Xor 1234h = 4582h
4582h = 17794 ( in the decimal )

And 17794 is the correct serial for the name: tnhuan.

Now, I will show you the calculation to make a keygen for this crackme:

       .Change yourname to UpCase( Your name)
       .Get the Ascii value
       .Change the result to Hex.
       .Xor it with 5678h.
       .Then Xor the Result with 1234h
       .And finish : change the result : Hex to Decimal.


I think it's not to difficult to make a keygen for this crackme and I hope this tutorial will
help you some about cracking....


......tnHuAn


( email : tnhuan19@hotmail.com).