Target: TRES 2000 crackme#3
Cracked by: 1of00
Level: easy
Tools: W32dasm89(+patch by Cold Coder)
______________________________________________________________________ 
Step 0:
Run the app and gather the info.

Step 1: 
Info: The right sequence of pushed buttons unlocks the app

Step 2: 
Disassemble it and go to SDR and find the string "Not...., You aren't a good cracker. "
Scroll up and see        :
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004089DD(C)
|
go there
:004089DD 7570                    jne 00408A4F <- good/bad jump
 before the jump is the calculation routine 
......................... 
:0040896A FF15B0104000            Call dword ptr [004010B0]
:00408970 660FAF7DE8              imul di, word ptr [ebp-18] <- di=num*col
:00408975 0F80BF010000            jo 00408B3A
:0040897B 660FAF7DDC              imul di, word ptr [ebp-24] <- di=di*row
:00408980 8B5E38                  mov ebx, dword ptr [esi+38] <- stored value
:00408983 668B4E34                mov cx, word ptr [esi+34] <- counter
:00408987 0F80AD010000            jo 00408B3A 
:0040898D 0FBFC7                  movsx eax, di <- eax=di
:00408990 03C3                    add eax, ebx <- eax=eax+stored value
:00408992 0F80A2010000            jo 00408B3A
:00408998 6683C101                add cx, 0001 <- increase counter
:0040899C 894638                  mov dword ptr [esi+38], eax <- store value
:0040899F 0F8095010000            jo 00408B3A
:004089A5 6683F906                cmp cx, 0006 <- pushed 6 times?
:004089A9 66894E34                mov word ptr [esi+34], cx 
:004089AD 0F851E010000            jne 00408AD1 <- if cx<6 then jump
:004089B3 69C087D61200            imul eax, 0012D687 <- eax=eax*1234567[dec]
:004089B9 0F807B010000            jo 00408B3A
:004089BF 894638                  mov dword ptr [esi+38], eax
:004089C2 3DAA663655              cmp eax, 553666AA  <- is eax 553666AA[hex]
:004089C7 B904000280              mov ecx, 80020004
:004089CC B80A000000              mov eax, 0000000A
:004089D1 894D90                  mov dword ptr [ebp-70], ecx
:004089D4 894588                  mov dword ptr [ebp-78], eax
:004089D7 894DA0                  mov dword ptr [ebp-60], ecx
:004089DA 894598                  mov dword ptr [ebp-68], eax
:004089DD 7570                    jne 00408A4F <- jump if different else-+ 
         ...                                                             |
         ...                    |----------------------------------------+
                                V
* Possible StringData Ref from Code Obj ->"Right! Now, write a tutorial, "

Step 3: 
The formula: 

Value=Value+Num*col*row;
Value needs to be $553666A/$12D687
Combine it your self
Mine is 25,20,10,7,2,1
25*5*5+20*5*4+10*5*2+7*2*2+1*1*1=1158=$553666A/$12D687;

[another could be 24,24,14,5,2,1]

Step 4:
I could write a prog that calculates this for but it's simple
and no need to do it


Contanct: 1of00@gmx.net