Author | Acid_Cool_178 |
Target | StealthFighter Crackme 2.0 |
Download it from | http://stealthfighter.cjb.net |
Public Release | 20 March 2001 |
Author Contact | acid_cool_178@hotmail.com |
Dedication | +DaFixer for DeDe |
Difficulty Level (1..7) | 4 (Medium) |
Tools Required | Language UPX DeDe (I'm are using version 2.50) OllyDbg (Not needed) |
Download it from | http://www.protools.cjb.net |
|
StealthFighter
had one strange crackme, he's first crackme.. Name and serial, serial was only
"iamnotalooser" and that serial worked for every name that you entered..
Se my tut 17 for more info on that one.
And on this crackme so is the protection really hard thought trough.
|
This crackme have one Name and serial, this serial is generated from the name.
I used AcidCool as the name
Run language and you will see that it's packed with UPX, unpack it and open it in DeDe
On Button2Click will you see this.
00432120
53
push ebx
00432121
8BD8
mov ebx, eax
00432123
8BC3
mov eax, ebx
|
00432125
E8AEFCFFFF
call 00431DD8 <-- FIRST CALL
0043212A
8BC3
mov eax, ebx
|
0043212C
E8E3FDFFFF
call 00431F14 <-- SECOND CALL
00432131
8BC3
mov eax, ebx
|
00432133
E814FFFFFF
call 0043204C <-- THIRD CALL
00432138
5B
pop ebx
00432139
C3
ret
;=============================================================================
; FIRST CALL
;=============================================================================
This call is getting the Name and checking it it it's over 4 chars and etc.
IF no name entered then show a bad message and if not then continue to SECOND
CALL
;=============================================================================
; SECOND CALL
;=============================================================================
00431F2D
64FF30
push dword ptr fs:[eax]
00431F30
648920
mov fs:[eax], esp
00431F33
8D55F0
lea edx, [ebp-$10]
00431F36
8B87DC010000
mov eax, [edi+$01DC]
* Reference to:
controls.TControl.GetText(TControl):System.String; <--
Gets the Name
|
00431F3C
E8D380FEFF
call 0041A014<-- executes the
function
00431F41
8B45F0
mov eax, [ebp-$10]<-- EAX == Length
of name
00431F44
8D55F4
lea edx, [ebp-$0C] <-- EDX ==
Name
* Reference to:
sysutils.LowerCase(S: <-- convert Name to
lowercase
|
00431F47
E8CC44FDFF
call 00406418 <-- Executes the
function
00431F4C
8B45F4
mov eax, [ebp-$0C] <-- EAX ==
Name in lowercase
|
00431F4F
E86C18FDFF
call 004037C0
00431F54
8BD8
mov ebx, eax <-- EBX == Length
of name
Start of LOOP 1
00431F56
85DB
test ebx, ebx <-- Jump when EBX == 0
00431F58
7E14
jle 00431F6E <-- Jump out of
the loop
00431F5A
BE01000000
mov esi, $00000001 <-- ESI ==
Counter
00431F5F
8B45F4
mov eax, [ebp-$0C] <-- EAX ==
Name in lowercase
00431F62
0FB64430FF
movzx eax, byte ptr [eax+esi-$01] <-- takes
one char from the name
00431F67
0145FC
add [ebp-$04], eax <-- Adding
the chars
00431F6A
46
inc esi<-- increase ESI
00431F6B
4B
dec ebx <-- decrease EBX
00431F6C
75F1
jnz 00431F5F <-- LOOP
Loop 1 END
EAX == Name
ESI == Counter 1, counting up to the length of the name
EBX == Counter 2, counting down to zero
EBP-$04 == Pointer to the Name chard added together, a+b+c+d....n
00431F6E
8D55F0
lea edx, [ebp-$10]
00431F71
8B8700020000
mov eax, [edi+$0200]
* Reference to:
controls.TControl.GetText(TControl):System.String;<--
Gets the text "CrackThePlanet"
|
00431F77
E89880FEFF
call 0041A014 <-- Executes the
function
00431F7C
8B45F0
mov eax, [ebp-$10] <-- EAX ==
"CrackThePlanet"
|
00431F7F
E83C18FDFF
call 004037C0 <-- Gets the length of
"CrackThePlanet"
00431F84
8BD8
mov ebx, eax <-- EBX == Length
of "CrackThePlanet" == E
00431F86
85DB
test ebx, ebx<-- Checks if EBX == 0
00431F88
7E22
jle 00431FAC <-- IF EBX == 0
then jump
00431F8A
BE01000000
mov esi, $00000001 <-- ESI ==
Up counter
Start of LOOP 2
00431F8F
8D55F0
lea edx, [ebp-$10]<-- EDX==
"CrackThePlanet"
00431F92
8B8700020000
mov eax, [edi+$0200]
* Reference to:
controls.TControl.GetText(TControl):System.String; <--
Gets "CrackThePlanet"
|
00431F98
E87780FEFF
call 0041A014 <-- executes the
function
00431F9D
8B45F0
mov eax, [ebp-$10] <-- EAX ==
"CrackThePlanet"
00431FA0
0FB64430FF
movzx eax, byte ptr [eax+esi-$01]<-- Takes
one char of "CrackThePlanet"
00431FA5
0145F8
add [ebp-$08], eax <-- Adding
the chars
00431FA8
46
inc esi <-- Increasing ESI
00431FA9
4B
dec ebx <-- Decreasing EBX
00431FAA
75E3
jnz 00431F8F <-- Jump to start
of loop 2
End of Loop 2
EAX == CrackThePlanet
ESI == Upconter
EBX == Downconter
EBP-$08 == The result of C+r+a+c+k+T+h+e+P+l+a+n+e+t in HEX wich is 569
00431FAC
8D55F0
lea edx, [ebp-$10] <-- EDX ==
"CrackThePlanet"
00431FAF
8B87DC010000
mov eax, [edi+$01DC]
* Reference to:
controls.TControl.GetText(TControl):System.String;<--
Gets the Name
|
00431FB5
E85A80FEFF
call 0041A014 <-- Executes the
function
00431FBA
8B45F0
mov eax, [ebp-$10]<-- EAX ==
Name in ASCII
|
00431FBD
E8FE17FDFF
call 004037C0 <-- Gets the length of
name
00431FC2
F76DF8
imul dword ptr [ebp-$08] <-- Multiply
Length of name with 569
00431FC5
8945F8
mov [ebp-$08], eax <-- Store
the result at EBP-$8
00431FC8
8D55E8
lea edx, [ebp-$18]
00431FCB
8B45FC
mov eax, [ebp-$04] <-- EDX ==
the sum of name (hex)
* Reference to:
sysutils.IntToStr(Value: <-- Convert sum of name
to ASCII (also converting to DECIMAL)
|
00431FCE
E8AD46FDFF
call 00406680 <-- executes the
function,
00431FD3
FF75E8
push dword ptr [ebp-$18] <-- EBP-$18
== The ASCII Value of out name
00431FD6
6848204300
push $00432048
00431FDB
8D55E4
lea edx, [ebp-$1C]
* Reference to Form1
|
00431FDE
8B45F8
mov eax, [ebp-$08]<-- EAX ==
2B48
* Reference to:
sysutils.IntToStr(Value: <-- Convert 2B48 to
DECIMAL and to ASCII wich is 11080
|
00431FE1
E89A46FDFF
call 00406680 <-- Executes the
function
00431FE6
FF75E4
push dword ptr [ebp-$1C] <-- EBP-$1C
== The result
00431FE9
8D45EC
lea eax, [ebp-$14]
00431FEC
BA03000000
mov edx, $00000003 <-- EDX == 3
|
00431FF1
E88A18FDFF
call 00403880 <-- Makes the string,
"SUM OF NAME-11080"
00431FF6
8B55EC
mov edx, [ebp-$14]
00431FF9
8B8704020000
mov eax, [edi+$0204]
* Reference to:
controls.TControl.SetText(TControl;System.String);
|
00431FFF
E84080FEFF
call 0041A044
00432004
33C0
xor eax, eax
00432006
5A
pop edx
00432007
59
pop ecx
00432008
59
pop ecx
00432009
648910
mov fs:[eax], edx
;=============================================================================
; THIRD CALL
;=============================================================================
In here is our Serial
compared and it it's correct then the good message will appear
else the bad message will appear...
here is what worked for me
Name:AcidCool
serial:830-11080
Now, lets try one small example
I used the name AcidCool wich have the length 8 and will be acidcool on lower case. a == 61h c == 63h i == 69h d == 64h c == 63h o == 6Fh o == 6Fh l == 6Ch
Loop1 == 61h Loop2 == 61h + 63h == C4h Loop3 == C4h + 69h == 12Dh Loop4 == 12Dh + 64h == 191h Loop5 ==191h + 63h == 1F4h Loop6 == 1F4h + 6Fh == 263h Loop7 == 263h + 6Fh == 2D2h Loop8 ==2D2h + 6Ch == 33Eh
Sum of "CrackThePlanet" == 569h
569h * 8h == 2B48h == 11080 in Decimal 33Eh == 830 in decimal
Serial == 830-11080
|
Well well, another Crackme keygenned with help of DeDe.. One brilliant tool for everyone that want to learn to keygen Delphi applications
Special Greetings:
LaZARuS
for he's great tutorials....
+DaFixer
for DeDe
The Cracking
Answer for not
even bugging me for writing or cracking anything, that group roxx!!!! You will
get alotta work from me now soon :D
StealthFighter
for good crackmes
Groups: HF, ID,
TCA, GC, TMG
Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton,
Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Stealhfighter, Eddie Van Camper,
CD_Knight and all the rest that i have forgotten
|