============================================================================================
Run crackme >> enter your details >> go to Soft-Ice and type bpx hmemcpy and go back >> press Check button
>> you're kicked into Soft-Ice >> disabled the breakpoint bd * and press F11 key to get to the CALLer >> then keep
pressing F12 key till you are in the crackme's (32-bit) code (about 11 times). You should see this code:
============================================================================================

:0045B85B call 00403B58
:0045B860 movzx edi, byte ptr [ebp+FFFFFEFF]
:0045B867 test edi, edi
:0045B869 jle 0045B8AF
:0045B86B lea eax, dword ptr [ebp+FFFFFF00]
:0045B871 lea edx, dword ptr [ebp+FFFFFE00]
:0045B877 mov cl, byte ptr [eax]_____________; Move 1st char to CL (type ? CL to see the char)
:0045B879 mov bl, byte ptr [edx]_____________; Move 1st fake number to BL (type ? BL to see the number)
:0045B87B mov byte ptr [ebp-01], bl__________; Move 1st fake number into [ebp-01]
:0045B87E mov esi, ecx___________________; Move 1st char into ESI
:0045B880 and esi, 000000FF
:0045B886 xor ecx, ecx
:0045B888 mov cl, byte ptr [ebp-01]__________; Move 1st fake number from [ebp-01] to ECX
:0045B88B xor esi, 00000237_______________; ESI = ESI [=1st char] xor $237
:0045B891 add ecx, 0000015E______________; ECX = ECX [=1st fake number] + $15E
:0045B897 xor ecx, 0000007B_______________; ECX = ECX xor $7B
:0045B89A cmp ecx, esi____________________; If ESI = ECX then [jump] Good message, if not [dont jump] Wrong message
:0045B89C je 0045B8AA

* Possible StringData Ref from Code Obj ->"Wrong serial, you are a bad cracker. " ->"Please try again"

============================================================================================
We have here an easy equation ($ means the number is in HEX):

1st char xor $237 = $7B xor (x + $15E)

with unknown = x (= this is real serial)
============================================================================================
Example: I entered: T as a name and number 5 as a fake serial. So the equation is:
(Notes: T in HEX = $54, 5 in HEX = $35)

$54 xor $237 = $7B xor ($35 + $15E)

$263 = $7B xor $193

$263 = $1E8 =>> and this is false (= wrong message)

ECX = ESI (= in the crackme's code)
============================================================================================
So I made litltle brute force keygen. The keygen increase the unknown x till the equation is equalize.
============================================================================================
Correct equation (for T):
(with my keygen the real number in HEX is $BA)

$54 xor $237 = $7B xor ($BA + $15E)

$263 = $7B xor $218

$263 = $263 =>> and this is true (= good message)

Comment to source code:

1) Name of the procedure
2) Declaration of thevariables
3) Declaration of the variables - continue
4) begin
5) Loop
6) begin of the first loop
7) First part of the equation: char xor $237
8) Loop - if not temp = temp1 then increase x
9) begin of the second loop
10) increase x
11) core of the equation
12) end of the second loop
13) make result (in ASCII)
14) make result (in Decimal)
15) print result
16) print reslut
17) end of the first loop
18) end


Variables:

temp = ECX (in the crackme's code)
temp1 = ESI (in the crackme's code)
x = the real serial for each char
a = helping variable
result = result in the ASCII value (the final real serial)
result1 = result in the Decimal value (you need this values convert into ASCII values); I have added space (' ') between each number for better recognition.


Warning:

The longer string you type in the keygen the longer will be the time to keygen it!!!
At first try it with one char!!!
To keygen my nick (stealthFIGHTER) lasts about 8 - 9 minutes.

1)_procedure TForm1.BruteForce;
2)_Var_temp, temp1, x, a : Integer;
3)_____result, result1 : string;
4)_begin
5)_for a := 1 to length(edit1.text) do
6)___begin
7)___temp := Ord(Edit1.text[a]) xor $237;
8)___while temp<>temp1 do
9)______begin
10)________inc(x);
11)________temp1 := (Ord(x) + $15E) xor $7B;
12)_____end;
13)___result := result + chr(x);
14)___result1 := result1 + inttostr(x) + ' ';
15)___Edit2.text := result;
16)___Edit3.text := result1;
17)__end;
18)_end;