Cracking Laokoons VB Crackme #1
Written
by Phueghy
though Lao told us in his readme, that this crackme should be "quite hard to crack,
but it is definitely crackable", I just cracked and keygened it in about 15 mins.,
considering myself not very advanced. he put many boobietraps inside, e.g. multiplying
with 0 or just subtracting two equal numbers.
W32Dasm V8.93- for the deadlisting and debugging the final code
SmartCheck V6.03 for VB-debugging
http://crackmes.cjb.net
Phuegy Keygen
But now... lets get it on!
my first approach to this crackme was via SmartCheck, where i found a comparison routine with a valid serial for my
name/company combination (i chose Phueghy/Tres2k).
fire up smartcheck and start the crackme. enter the information and a fake serial.
a message box pops up, saying "nope, thats not it". we gonna change this ;-)
so leave the messagebox on the screen and look into smartcheck.
click onto the event Command1_click and expand it. a bit down you see the call to the messagebox:
MessageBox(VARIANT:String"That's n...", INTEGER....etc.)
click on that line and activate the view for all events (the button with the yellow sign)
you find much more code than before. look up a bit until you see __vbaVarTstEql. click on that line, and look into the right window. there are two numbers (strings) compared: our fake serial. and.. the correct one! so at least we found a correct serial.
look up a bit more in the code, to see the __vbaVarMove, where the calculated serial is stored in a variable. we'll use this for the keygen.
well, lao wants us to keygen the whole thing. therefore we gotta analyse the keygen-procedure. seeing many calls to asc or len i decided to go over and use w32dasm for inspecting the calculating routine.
so fire up wdasm and disasm the crackme (hope ou have the vb-sdr patch..)
remember how we found the serial in smartcheck? yes, look up the imported functions and search for __vbaVarMove:
* Reference To: MSVBVM50.__vbaVarMove, Ord:0000h
|
:00409406 FF1504B14000 Call dword ptr [0040B104]
:0040940C 8D4590 lea eax, dword ptr [ebp-70]
i guess this is the right one (there are 2 others), because it stands before the other calls for vbafreestrlist, just as you can see in smartcheck
so let have a look.
scroll up till you find this line:
:004092A1 8B4DA8 mov ecx, dword ptr [ebp-58] <- copies your company to ecx (vb-notation: T.r.e.s.2.k.)
* Reference To: MSVBVM50.__vbaLenBstr, Ord:0000h
|
:004092A4 8B350CB14000 mov esi, dword ptr [0040B10C]
so this determines to length of your company and stores it in eax,
:004092B0 8BD8 mov ebx, eax ;copies it to ebx and does the same with your name.
:004092BB 03D8 add ebx, eax ; these values are added together
:004092BD 8B45A4 mov eax, dword ptr [ebp-5C]
:004092C0 50 push eax
:004092C1 0F80B7050000 jo 0040987E
:004092C7 FFD7 call edi
this grabs the 1st letter of your name and stores it in eax
it is added to ebx (sum of len(serial) and len(name) ) via ecx
now it takes to last letter of the name to store the hex code in eax:
:004092D1 52 push edx
:004092D2 0F80A6050000 jo 0040987E
:004092D8 FFD7 call edi
:004092DA 899D2CFEFFFF mov dword ptr [ebp+FFFFFE2C], ebx
-> you should note these operations on a sheet of paper, do you don't loose the overview....
it grabs again the length of your comp. and adds it to the hex value of the last char.
the following subtractions are unneccessary, mostly leading to 0 or something unused.
the next interesting part happens here:
:00409368 FF1520B14000 Call dword ptr [0040B120]
:0040936E 8B55CC mov edx, dword ptr [ebp-34]
:00409371 52 push edx
:00409372 0FBFF8 movsx edi, ax
:00409375 FFD6 call esi
:00409377 0FAFF8 imul edi, eax
it takes the 1st letter again and multiplies it with the length of the comp
now some more boobytraps inside, till we come to:
:00409396 03FB add edi, ebx ; edi=len(comp)*hex(1st namechar)
:00409398 8B9D24FEFFFF mov ebx, dword ptr [ebp+FFFFFE24]
:0040939E 0F80DA040000 jo 0040987E
:004093A4 03DF add ebx, edi
once more the values are shifted, till once more len(name) is added:
:004093B2 03D8 add ebx, eax
and the calculation goes on...
:004093CD 0FAFF8 imul edi, eax <- 1st char * len(comp)
:004093D0 8B5590 mov edx, dword ptr [ebp-70]
:004093D3 52 push edx
:004093D4 0F80A4040000 jo 0040987E
:004093DA FFD6 call esi
:004093DC 0FAFF8 imul edi, eax <- once again
so it is: 1st char * lenē(comp)
:004093DF 0F8099040000 jo 0040987E
:004093E5 03DF add ebx, edi ; at least to two values
are added together to leave the real serial in ebx!
wow, that was a lot of work. we had to separate all the unimportant multiplications and the real important calcutating, but at least we did it.
now lets reconstruct this algorithm in vb (or whatever, i just use vb)
i am sure if you noted down enough and traced through the code thouroughly you will find the following formula for keygenning the crackme:
serial = hex(1st char) * lenē(company) + hex(1st char) * len(company) + [len(name) + len(company)] + len(serial)
that makes us ready for coding the final keygen: (vb-source)
Private Sub Command1_Click()
lencomp = Len(Text2.Text) ' get all the text input and lens
lenname = Len(Text1.Text)
erster = Asc(Left(Text1.Text, 1))
letzter = Asc(Right(Text1.Text, 1))
ser = erster * lencomp * lencomp + erster * lencomp
ser = ser + lenname + lencomp + lenname
Text3.Text = ser
End Sub
great, it works.
another crackme cracked.
though it really isn't unsolvable, it has some tricks which you have to discover and you must have an eye on the variables *g.
well i hope you liked my tut, send any critics or else to Phueghy@gmx.de
My Greetz Goes to:
Laokoon
everyone in #Cracking4newbies
everyone in #win32asm
tnHuan and all members of Tres2000
and all who I forgot..
When ever there is a door,
there is an entrance.
And behind an entrance can no secret hide,
when a cracker takes his knowledge for a ride
McCodEMaN
As this is an essay on cracking a crackme (specially designed for cracking) you don't need to buy it (although i'm sure, Laokoon won't mind *g)
Essay written by Phueghy ©TRES2000. All Rights
Reversed.