Genocide Crew Crackme
Version 3.0 by Falcon
Written by tnHuAn
|
Introduction |
Hi, Do you know Genocide Crew? This group is one of good cracking group which
I like. I like this group because
this group have many good crackme, hmm I think all of their crackme are great.
And I like to crack it.... Today is a
not happy day, my computer have some viru,...I must back up my hard disk, and
resetup my computer.
When I back up my disk, I found some old crackmes , one of them is : Genocide
Crew Crackme 3.
Hmm, I must crack it when I complete my work. And... Lucky, I crack it succesful.
Well, this tutorial will show you : HOW TO REGISTER GONOCIDE CREW CRACKME 3.
|
Tools required |
You can find all tool at : http://crackpltools.prv.pl and at your home.
|
Target's URL |
|
Essay |
First run this crackme.Oh, very cool logo,...
Enter fake name and fake serial. I use :
Name : tnhuan
Serial : 123456789
Press Ctrl+D, to pop up SoftIce, set a breakpoint at Hmemcpy, so type : bpx Hmemcpy, press Enter.
Then, press F5 to return crackme, Click OK, you well kicked into SoftIce. Now, press F5 once ,and keep
press F12 until you are in the code of Crackme, use F10 to trace until you see this important code :
Lea Eax, [ Ebp-60 ]
Mov Ebx, [ Ebp-04 ]
Movzx Ebx, Btype Ptr [Edx+Ebx-01]
Mov [Eax], Ebx
Mov Esi, Ebx
Imul Esi, Edx
Mov Eax, Esi
Add [Ebp-10], Esi
Inc Edx
Add Eax, 04
Dec Ecx
Jnz 0042C33D
Mov Eax, [ Ebp-10]
Cmp Eax, [0042D888] <---- Type : d 0042D888 , you will see : E9Dh
Jnz 0042C33D
Hmm look at this part of code . It look like a loop, but I can't make you understand this part of code, so I will write
this part of code into Pascal Language, and I hope you know Pascal. If you know Pascal, you can understand it
easier.
Const [0042D888] = $ED9
For i:=1 to length( name) do
Begin
ch:= Name[i];
Ebx := Ord ( ch );
Esi:= Ebx;
Esi:=Esi*i;
[Ebp-10]:= [Ebp-10]+Esi
End;
Eax:= [ Ebp-10];
If Eax= [0042D888] then ..........
Ok, I hope you understand, now we continue. This crackme calculate my name, and after calculation , my name
will show as a number , this number must = $E9D. The calculation is :
My name is : ABCDEF : Hex ( A ) = a
Hex ( B )= b
Hex (C )= c
.....................
Hex ( F )= f
And it will make :
a*1=X
b*2+X=Y
c*3+Y=Z
d*4+Z=I
e*5+I=J
f*6+J=K . And K must = $E9D= 3741
Now, I must reverse this calculation to find the correct name. I think , my name will have 10 character. Why ?
You see : finish of 3741 is : 1, so we can find a number which finish = 1, as the result will mod 10=0
Now use my tool. Ex : Type in 9 Char : 1addad114, you will see at the Decimal= 3231.
Well, finish = 1, this is all we need . Continue : 3741-3231= 510, 510/10 = 51.
Ok, chr ( 51 )= '3'. So we have a correct name is : 1addad1143.
Do you understand? If not, make another example : type in 9 char : 1dddd1143, Decimail will= 2961.
Oh, yes ... Finish = 1, that all we need, now : 3741-2961 = 780, 780/10= 78.
Chr( 78) = ' N ', so correct name is : 1dddd1143N.
I found some correct name : 1addad1143
1dddd1143N
1ddda1732M
1dxda1732G
I know there are many many correct name.
Now you have correct name, so you can find the serial.
Continue trace the code , you will see this code :
Mov Eax, [ 0042D888] <---- Eax always = $E9D
Mov Ecx, 003 <---- Ecx= 3
CDQ
IDIV Ecx <---- Eax / Ecx
......................................
Can you remember ? [ 0042D888 ] is a constant , and it always = $E9D
So serial is always = Eax / Ecx = $ E9D / 3 = $4DF = 1247
Hmm Serial is a constant , so all of this crackme is the name.
Now I tired, I show you some correct result :
Name : 1addad1143 / 1dddd1143N / 1ddda1732M / 1dxda1732G
Serial : 1247
/ 1247 / 1247
/ 1247
Crackme Cracked. huh?
|
Final Notes |
Hmm, this crackme is not a easy crackme, and not a too difficult crackme. So I think this
crackme is very inresting for all cracker? He he...
If you want comment me something about this tutorial please email to me :
And all I miss...
|
|