Make keygen for:Fireworx Crackme 12
Version 12 by Fireworx
Written by tnHuAn
|
Introduction |
Hi, Do you know FireWorx? If Not, please visit their website.
In that site have many crackme, many tutorial which I sure it very useful for you. Now we will make keygen for this crackme. I usually code keygen in VB or Delphi, but with this keygen I coded in Win32asm, Why? Because I want you know : to make a keygen, the easiest way is code in Win32asmm, because your source in win32asm is same with soure code you find in SoftIce, and it will easier. Huh?
|
Tools required |
You can find all tool at : http://crackpltools.prv.pl and at your home.
|
Target's URL |
Sorry , I can't remember the URL of the site where I downloaded this crackme.
|
Essay |
Now, run the crackme. Ohhhh...., the crackme with full graphic,.... Very nice , but I hate it.Enter some fake name, company and serial in 3 textbox.I used :
Then DoubleClick in ' OK ', hmmm not happen.. Ok, Ctrl+D to popup SoftIce, set a breakpoint on Hmemcpy. Then press F5 to return crackme, and doubleclick in 'Ok ' again... You will kicked in SoftIce, now press F11 once, and Press F12 until you in this crackme code. Using F10 to trace the code, until you see this code :
0045545E E801E6FAFF call 00403A64<---
Get your serial
00455463 8BF0 mov esi, eax<--- Esi = Eax = length
of your serial
00455465 85F6 test esi, esi <--- Test Esi
00455467 7E75 jle 004554DE <--- jump if <=
00455469 BF01000000 mov edi, $00000001 <--- Edi= 01
0045546E 8B45F4 mov eax, [ebp-$0C]
00455476 50 push eax
00455477 6BC77B imul eax, edi, $7B <--- Eax = Edi*
$7B
0045547A 5A pop edx
0045547B 8BCA mov ecx, edx <--- ecx = edx
0045547D 99 cdq
0045547E F7F9 idiv ecx <--- eax = eax /
ecx
00455480 C1E005 shl eax, $05 <--- Shift Left eax
with $05
00455483 2D5C112C00 sub eax, $002C115C <--- Eax = eax -
$002C115C
00455488 05B02E8700 add eax, +$00872EB0 <-- eax = eax +
$00872EB0
0045548D 83F012 xor eax, +$12 <--- Eax = Eax Xor $12
At this line, type in SoftIce : ? Eax , you will see the number : 5971526, and this number is your correct seial.
I think : you will understand without my explain, because this code is very short, and you can understand easily. huh?
If you want to see my keygen source. Here is full source of my keygen, I coded it in MASM :
;------ Start of source file ----
.386
.model flat, stdcall
option casemap :none ; case sensitive
;------- Include libary of MASM32-------
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
;--------This is a Macro--------------------
szText MACRO Name, Text:VARARG
LOCAL lbl
jmp lbl
Name db Text,0
lbl:
ENDM
;------------------------------------------------
WndProc PROTO :DWORD,:DWORD,:DWORD,:DWORD
;------------------------------------------------
.data
;------- This is variable with value of this keygen------------
AboutMsg db "--o0o Key Generator for Fireworx Crackme 12 by tnHuAn/Tres2K o0o--"
db 0dh,0ah, " Special thank : BiSHoP / Lockless for his keygen template", 0dh,0ah
db 0dh,0ah, "Greeting to : McCodeMan, Sphinx, WiseMan...and All member of Tres2000",0dh,0ah
db "BiSHoP, a_evil, Hl_ruby, Bombman, Acid_Cool_178, stealFighter, The Analyzer, ",0dh,0ah
db "Eddile Van Camper, NixHextc, Spyder, .... And all I miss...Of course my lover....",0dh,0ah
db 0dh,0ah,"Greetz to group : Digital Insight, Hellforge, Tres2000, LockLess...",00
Caption db "FireWork Crackme12 Keygen, made by tnHuAn",0
moremsg db "Name must be 2 letters or longer",0
moremsgco db "Company must be 2 letters or longer",0
dlgtitle db "tnHuAn's Keygen for Firework Crkme12",0
hInstance dd 0
hIcon dd 0
;-----This is varialbe without value in keygen------
.data?
buffernalen db 512 dup(?)
buffercolen db 512 dup(?)
buffer2 db 512 dup(?)
bufferco db 512 dup(?)
bufferna db 512 dup(?)
;--------Resource of this keygen --------
.const
KEYGEN equ 102
IDC_STATIC equ -1
IDC_NAMEBOX equ 1000
IDC_COMPANYBOX equ 1001
IDC_SERIALBOX equ 1002
IDC_REGBUTTON equ 1003
IDC_ABOUTBUTTON equ 1004
IDC_CANCELBUTTON equ 1005
;-------Begin part of Code in this keygen---------
.code
start:
; #########################################################################
invoke GetModuleHandle, NULL
mov hInstance, eax
invoke DialogBoxParam,hInstance,KEYGEN,0,ADDR WndProc,0
invoke ExitProcess,eax
; #########################################################################
WndProc proc hWin :DWORD,
uMsg :DWORD,
wParam :DWORD,
lParam :DWORD
.if uMsg == WM_INITDIALOG
invoke SendMessage,hWin,WM_SETTEXT,0,ADDR dlgtitle
xor eax, eax
.elseif uMsg == WM_COMMAND
.if wParam == IDC_REGBUTTON ; ------If click ' Make It ' button-----
push 100h
push offset bufferna
push IDC_NAMEBOX
push hWin
call GetDlgItemTextA ;-------Get your name ------
mov dword ptr [buffernalen],eax ; ---- Save the lenght of your name-----
cmp eax, 2h ; ------Compare with 02-------
jl @morelettersna ;------ jump if <
push 101h
push offset bufferco
push IDC_COMPANYBOX
push hWin
Call GetDlgItemTextA ; -----Get your company------
mov dword ptr [buffercolen],eax ; ----- Save the length of your company----
Cmp eax, 2h ;----- Compare with 02
jl @morelettersco ; -------Jump if <
call KeyGeneration ; ----- Call the calculation for correct serial
;------Write the correct serial in textbox serial -----
push dword ptr [buffer2]
push IDC_SERIALBOX
push hWin
call SetDlgItemInt
.elseif wParam == IDC_ABOUTBUTTON ; ----if click 'About' button---
push MB_OK ;---- the 'Ok' button in message box----
push offset Caption ;--- the caption of message box ----
push offset AboutMsg ; ---- the content of message box----
push 0
call MessageBoxA ; ---- Call API function MessageboxA to show message box
.elseif wParam == IDC_CANCELBUTTON ; ---- If Click 'Cancel' button----
invoke EndDialog,hWin,0 ;---- Call API function EndDialog---
.endif
.elseif uMsg == WM_CLOSE ;---- If Click 'Close' Button---
invoke EndDialog,hWin,0 ; ---- Call API function EndDialog---
.endif
xor eax, eax
ret
@morelettersna: ;---Show error about length of Name---
push offset [moremsg]
push IDC_SERIALBOX
push hWin
call SetDlgItemTextA
ret
@morelettersco: ;--- Show error about length of Company----
push offset [moremsgco]
push IDC_SERIALBOX
push hWin
Call SetDlgItemTextA
ret
WndProc endp
KeyGeneration PROC ;---- the calculation for correct serial
mov ecx,01
mov edx,dword ptr [buffercolen]
mov eax,dword ptr [buffernalen]
add edx,eax
mov eax, edx
push eax
imul eax,ecx,7Bh
mov ecx,edx
cdq
idiv ecx
shl eax,05h
sub eax, 002C115Ch
add eax, 00872EB0h
xor eax,12h
mov dword ptr [buffer2], eax
pop eax
ret
KeyGeneration ENDP
end start
Hey, this is a source code for my keygen. You can edit a resource file, and use MASM to build this kegyen. Or your can use my keygen. Please click here to download me keygen.
What your idea ? Do you feel : KeyGeneration procedure very same the source code I get in SoftIce.
That is my idea, and finish this tutorial. See you again.
|
Final Notes |
I know, my keygen and my tutorial not is a best, so If you want to comment me. Please email:
All member of Tres2000: McCodEMaN, Sphinx, Leon,....
All member of HAH, and Eddile in Digital Insight
Acid_Cool_178 ( Crack my crackme#6), BiSHoP, a_evil, tKc,....
And all I miss. Oh yes! My girl friend, huh?
|
|