ZaiRoN
October 12th, 2002, 13:56
in the past days i have take a look at this target. I have tried to understand how the serial check is done without success.
is there someone who has tried to understand how the serial check is performed?
here is some info for those who want to help me:
Code:
004ACC90 CALL IP_TOOLS.004236F4 ; returns the length of the registration name
004ACC95 MOV EAX,DWORD PTR SS:[EBP-8] ; eax -> registration name
004ACC98 LEA EDX,DWORD PTR SS:[EBP-4]
004ACC9B CALL IP_TOOLS.00407B88 ; moves the name in a new buffer
004ACCA0 MOV EDX,DWORD PTR SS:[EBP-4] ; edx -> name
004ACCA3 MOV EAX,EDI
004ACCA5 CALL IP_TOOLS.00423724
004ACCAA LEA EDX,DWORD PTR SS:[EBP-8]
004ACCAD MOV EAX,DWORD PTR DS:[ESI]
004ACCAF MOV EDI,DWORD PTR DS:[EAX+1F4]
004ACCB5 MOV EAX,EDI
004ACCB7 CALL IP_TOOLS.004236F4 ; returns the length of the name
004ACCBC MOV EAX,DWORD PTR SS:[EBP-8] ; eax -> serial you have typed
004ACCBF LEA EDX,DWORD PTR SS:[EBP-4]
004ACCC2 CALL IP_TOOLS.00407B88 ; moves the serial in a new buffer
004ACCC7 MOV EDX,DWORD PTR SS:[EBP-4] ; edx -> serial
004ACCCA MOV EAX,EDI
004ACCCC CALL IP_TOOLS.00423724
as you can see it performs the same operation for both name and serial.
Code:
004ACCD1 LEA EDX,DWORD PTR SS:[EBP-8] ; edx -> serial
004ACCD4 MOV EAX,DWORD PTR DS:[ESI]
004ACCD6 MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACCDC CALL IP_TOOLS.004236F4 ; !?! don't know exactly !?!
004ACCE1 MOV EAX,DWORD PTR SS:[EBP-8] ; eax -> name
004ACCE4 CALL IP_TOOLS.0049578C ; is your name just registered!?!
004ACCE9 TEST AL,AL
004ACCEB JE SHORT IP_TOOLS.004ACD29
004ACCED PUSH IP_TOOLS.004ACF5C ; ASCII "Sorry, your registration name ("
004ACCF2 LEA EDX,DWORD PTR SS:[EBP-8]
004ACCF5 MOV EAX,DWORD PTR DS:[ESI]
004ACCF7 MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACCFD CALL IP_TOOLS.004236F4
004ACD02 PUSH DWORD PTR SS:[EBP-8]
004ACD05 PUSH IP_TOOLS.004ACF84 ; ASCII "
is found on the "Black List".
the crackme does a check on the registration name you have typed. in the exe (starting from offset 0x947A0) i have found some *strange* strings. these strings are firstly decrypted to a real name and then are used to check if a name has been reused.
for example:
the second encrypted name is: Rrucsglgadnr ARyauykmnovnxds FMvodrerrits
the call at 49C7C4 converts it in the real name: Ruslan Raimond Morris
the decryption is very easy to understand...1° char: yes, 2° char: no, 3° char: yes and so on
the question is: who are these persons? i don't think that the proggie updates the file with new registered user; does it have not much sense!?!
bha... go on:
Code:
004ACD29 LEA EDX,DWORD PTR SS:[EBP-8] ; [edx] -> registration name
004ACD2C MOV EAX,DWORD PTR DS:[ESI]
004ACD2E MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACD34 CALL IP_TOOLS.004236F4
004ACD39 CMP DWORD PTR SS:[EBP-8],0 ; the name must be != NULL
004ACD3D JE IP_TOOLS.004ACF0E
004ACD43 LEA EDX,DWORD PTR SS:[EBP-C]
004ACD46 MOV EAX,DWORD PTR DS:[ESI]
004ACD48 MOV EAX,DWORD PTR DS:[EAX+1F4]
004ACD4E CALL IP_TOOLS.004236F4
004ACD53 CMP DWORD PTR SS:[EBP-C],0 ; the serial must be != NULL
004ACD57 JE IP_TOOLS.004ACF0E
004ACD5D LEA EDX,DWORD PTR SS:[EBP-10]
004ACD60 MOV EAX,DWORD PTR DS:[ESI]
004ACD62 MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACD68 CALL IP_TOOLS.004236F4 ; returns the length of the name
004ACD6D MOV EAX,DWORD PTR SS:[EBP-10] ; eax -> registration name
004ACD70 CALL IP_TOOLS.0049E07C ; hmmm...creates buffer1 using the name
004ACD75 MOV EDI,EAX
004ACD77 LEA EDX,DWORD PTR SS:[EBP-10]
004ACD7A MOV EAX,DWORD PTR DS:[ESI]
004ACD7C MOV EAX,DWORD PTR DS:[EAX+1F4]
004ACD82 CALL IP_TOOLS.004236F4 ; returns the length of the serial
004ACD87 MOV EAX,DWORD PTR SS:[EBP-10] ; eax -> serial
004ACD8A CALL IP_TOOLS.0049E118 ; hmmm...creates buffer2 using the serial
004ACD8F CMP DI,AX ; first check !!!
004ACD92 JNZ IP_TOOLS.004ACF0E
004ACD98 MOV EAX,DWORD PTR DS:[4E22CC] ; eax -> buffer1
004ACD9D MOV EDX,1FF ; 1FFh = 511
004ACDA2 CALL IP_TOOLS.0049E060 ; checksum on 0x1FF-0x0B bytes starting from buffer1
004ACDA7 MOV EDI,EAX
004ACDA9 MOV EAX,DWORD PTR DS:[4E21D0] ; eax -> buffer2
004ACDAE MOV EDX,1FF ; 1FF = 511
004ACDB3 CALL IP_TOOLS.0049E060 ; checksum on 0x1FF-0x0B bytes starting from buffer2
004ACDB8 CMP EDI,EAX ; checksums must be equals
004ACDBA JNZ IP_TOOLS.004ACF0E ; second check !!!
004ACDC0 MOV EAX,DWORD PTR DS:[4E22CC]
004ACDC5 ADD EAX,7
004ACDC8 MOV EAX,DWORD PTR DS:[EAX] ; takes a dword from buffer1+7
004ACDCA MOV EDX,DWORD PTR DS:[4E21D0]
004ACDD0 ADD EDX,7
004ACDD3 CMP EAX,DWORD PTR DS:[EDX] ; compare between two dwords from buffer1+7 and buffer2+7
004ACDD5 JNZ IP_TOOLS.004ACF0E ; third and last check!!!
easy to understand. there are some different checks.
the only thing we have to do is to understand how buffer1 and buffer2 are created.
there is something interesting at 49F9E6/49F9FF where creates the buffer1.
would you like to help me
regards,
ZaiRoN
