/*****************************************
*    dATE: 01.01.2004                    *
*    tYPE: Tutorial                      *
*      bY: ManSun                        *
*--------------------------------------- *
* pROGRAM: Katar First CrackMe!          *
*     uRL: www.crackmes.de               *
*   tOOLS: Generic Unpacker for UPX      *
*          W32dasm v8.93                 *
*          Tola's Patching Engine        *
*   lEVEL: very easy (below 5 minutes)   *
*----------------------------------------*
*    iNFO: Packed UPX                    *
*****************************************/

Hello!
(This is my first solution in English and I apologize for my BAD English)

"Generic Unpacker for UPX" by Bratalarm you download on http://processor.at/asm

Crackme Rules:
- Crack it but no using ResHack or ResourceWorkshop
- you can unpack it but pack it later again

We simply fishing serial or generated loader ;)

[1]Fishing serial steps:
-We run "Generic Unpacker For UPX" and unpack this crackme
-We load unpack_crackme.exe in "W32dasm"
-We search string "WrOng PassWOrd" in 'String Data References' and double click this string
-We stand on the address line 004030A2
-We jump the referenced address 00403036 and look up on call MSVBVM60.__vbaFreeVarList
-We see string "YoungUruly", this string is GOOD PASSWORD
-We run crackme, click 'Chceck!' button, enter YoungUruly (click 'OK' button) and we have messagebox "Cr4cKiNg SuCid"
-Enjoy!


* Reference To: MSVBVM60.__vbaFreeVarList, Ord:0100h
                                  |
:00402FF3 FF1514104000            Call dword ptr [00401014]
:00402FF9 83C420                  add esp, 00000020
:00402FFC 8D55DC                  lea edx, dword ptr [ebp-24]
:00402FFF 8D854CFFFFFF            lea eax, dword ptr [ebp+FFFFFF4C]
:00403005 52                      push edx
:00403006 50                      push eax

* Possible StringData Ref from Data Obj ->"YoungUruly"  ;<-PASSWORD
                                  |
:00403007 C78554FFFFFF1C234000    mov dword ptr [ebp+FFFFFF54], 0040231C
:00403011 C7854CFFFFFF08800000    mov dword ptr [ebp+FFFFFF4C], 00008008

* Reference To: MSVBVM60.__vbaVarTstEq, Ord:0100h
                                  |
:0040301B FF1540104000            Call dword ptr [00401040]
:00403021 6685C0                  test ax, ax
:00403024 897DA4                  mov dword ptr [ebp-5C], edi
:00403027 89759C                  mov dword ptr [ebp-64], esi
:0040302A 897DB4                  mov dword ptr [ebp-4C], edi
:0040302D 8975AC                  mov dword ptr [ebp-54], esi
:00403030 897DC4                  mov dword ptr [ebp-3C], edi
:00403033 8975BC                  mov dword ptr [ebp-44], esi
:00403036 7457                    je 0040308F                       ;<-PATCHED JUMP
:00403038 8D954CFFFFFF            lea edx, dword ptr [ebp+FFFFFF4C]
:0040303E 8D4DCC                  lea ecx, dword ptr [ebp-34]

* Possible StringData Ref from Data Obj ->"Cr4cKiNg SuCcid"
                                  |
:00403041 C78554FFFFFF38234000    mov dword ptr [ebp+FFFFFF54], 00402338
:0040304B C7854CFFFFFF08000000    mov dword ptr [ebp+FFFFFF4C], 00000008

* Reference To: MSVBVM60.__vbaVarDup, Ord:0100h
                                  |
:00403055 FF157C104000            Call dword ptr [0040107C]
:0040305B 8D4D9C                  lea ecx, dword ptr [ebp-64]
:0040305E 8D55AC                  lea edx, dword ptr [ebp-54]
:00403061 51                      push ecx
:00403062 8D45BC                  lea eax, dword ptr [ebp-44]
:00403065 52                      push edx
:00403066 50                      push eax
:00403067 8D4DCC                  lea ecx, dword ptr [ebp-34]
:0040306A 53                      push ebx
:0040306B 51                      push ecx

* Reference To: MSVBVM60._adj_fdiv_m32, Ord:0253h
                                  |
:0040306C FF1524104000            Call dword ptr [00401024]
:00403072 8D559C                  lea edx, dword ptr [ebp-64]
:00403075 8D45AC                  lea eax, dword ptr [ebp-54]
:00403078 52                      push edx
:00403079 8D4DBC                  lea ecx, dword ptr [ebp-44]
:0040307C 50                      push eax
:0040307D 8D55CC                  lea edx, dword ptr [ebp-34]
:00403080 51                      push ecx
:00403081 52                      push edx
:00403082 6A04                    push 00000004

* Reference To: MSVBVM60.__vbaFreeVarList, Ord:0100h
                                  |
:00403084 FF1514104000            Call dword ptr [00401014]
:0040308A 83C414                  add esp, 00000014
:0040308D EB5B                    jmp 004030EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403036(C)
|
:0040308F 8D954CFFFFFF            lea edx, dword ptr [ebp+FFFFFF4C]
:00403095 8D4DCC                  lea ecx, dword ptr [ebp-34]

* Possible StringData Ref from Data Obj ->"Wr0ng PassW0rd"
                                  |
:00403098 C78554FFFFFF5C234000    mov dword ptr [ebp+FFFFFF54], 0040235C  ;<-STAY IT
:004030A2 C7854CFFFFFF08000000    mov dword ptr [ebp+FFFFFF4C], 00000008  


[2] Generated Loader
-Simply patch jump on NOP instruction

:00403036 7457   je 0040308F
          ^^^^
          9090

-I used "Tola's Patching Engine" to generated loader
-"Tola's Patching Engine" you download on http://www.void.gulli.com/tpe


P.S.
Katar in Polish language is catarrh. Take aspirin ;-D

gREETS:
_TeStON_ - secondary-school final exam is easy men (I passed him 5 years ago, with opinion very good) ;-)
