Okay

Need some thoughts please

I tried to disassemble skw.exe (site key generator) no luck.

Had a quick look has the usual .text, .data .tls .rdata .idata .edata .rsrc and .reloc

Followed by Have, a nice, day!

Thoughts on best way to handle this or if you have seen this before.


TIA

Hi peterg70,

"Have, a nice, day!"

Are those 3 Sections, or is it a line behind the last Section?

Cya...

CoDe_InSiDe

P.S. Can you maybe upload or give an URL for the file?

I'm also interested in the SDK files

skw.exe is packed with Crypkey's normal packer/encryptor. Those "Have" "a nice" "day!" sections are the code and data for the decrypting/unpacking code. I've found WinDbg, the debugger from the windows sdk to be very handy in unpacking such exe's. You can trace through them, then do a full dump of it with procdump, because windgb is controlling the process. No breakpoints or icedump or any other messy stuff to deal with Finding the OEP is easy... it's held in a memory location and then jumped to with jmp [whatever].

If your looking for the SDK for Crypkey

Do a google search for SDK and Crypkey

I hear korean sites are useful sites for downloading

GREAT! I just found v5.5b in a korean site cheers

I found Crypkey 5.7 sdk but it's passworded .

Ziggie

Ziggie

Where did you find it?? Google can seem to find anything these days.

I need a refresher course in Search engine searching !?

Off to the fravia site again.

Ziggie/Unregistered:
Search for Crypkey SDK: ["Crypkey SDK" "Crypkey Instant" "Crypkey STEALTH"]
Search for Installshied password recovery: [installshield password crack]

The password of this InstallShield version is very easy to crack.

Here is the fomula:

(00F143AC + 2 * (ASCII sum of password) ) ^ 00051993 = XXXXXXXX

XXXXXXXX can be found with SoftICE.