Hi all!

In the following code snippet a long double is read from a file, that's the required key. Then a checking function is called which performs a number of calculations. As I don't want to write a keygen (that's too complicated for me at the moment) I thought I could wrap a loop around the checking function to test all keys until a valid one is found. If a correct key is found I'd like to notice it somehow with the help of the check of the result (if this is the correct one ;-) below. I know that the correct key will be smaller than 2^40, so the loop might take some hours I think but that wouldn't be a problem. Can somebody give me some tips how to do this?

Thank you very much!
kolina

10013BAC lea ecx, [esp+5F0h+var_550]
10013BB3 push offset aR ; "r"
10013BB8 push ecx
10013BB9 call ds:fopen
10013BBF mov esi, eax
10013BC1 add esp, 8
10013BC4 test esi, esi
10013BC6 jz loc_10013C53
10013BCC lea edx, [esp+5F0h+var_5D8]
10013BD0 push edx
10013BD1 push offset aLf ; "%lf"
10013BD6 push esi
10013BD7 call ds:fscanf ; <--- READ LONG DOUBLE FROM FILE
10013BDD push esi
10013BDE call ds:fclose
10013BE4 lea eax, [esp+600h+var_5DD]
10013BE8 lea ecx, [esp+600h+var_5DA]
10013BEC push eax
10013BED mov eax, [esp+604h+var_5D4]
10013BF1 lea edx, [esp+604h+var_5DC]
10013BF5 push ecx
10013BF6 mov ecx, [esp+608h+var_5D8]
10013BFA push edx
10013BFB push eax
10013BFC push ecx
10013BFD call sub_100139E0 ; <--- THE CHECKING FUNCTION
10013C02 mov al, [esp+614h+var_5DD]
10013C06 add esp, 24h
10013C09 test al, al ; <--- CHECK IF RETURN IS CORRECT (?)
10013C0B jz short loc_10013C2E
10013C0D call dword_1001F9AC
10013C13 cmp ax, [esp+5F0h+var_5DC]
10013C18 jnz short loc_10013C2E
10013C1A mov dx, [ebp+arg_4]
10013C1E cmp [esp+5F0h+var_5DA], dx
10013C23 jnz short loc_10013C2E
10013C25 mov al, 1
10013C27 pop edi
10013C28 pop esi
10013C29 pop ebx
10013C2A mov esp, ebp
10013C2C pop ebp
10013C2D retn

10013BFD call sub_100139E0

disasemble that subroutine, see what it does, it sets a value on the stack for success as you noted, so trace it, see what the params passed are, worst case you can brute force it, best case, you'll find where it does a comparison to the 'valid' key and can grab the valid key from there... keep debuggin

10013BAC lea ecx, [esp+5F0h+var_550] ;ALL THIS CODE OPENS AND READS FROM FILE
10013BB3 push offset aR ; "r" ;REPLACE IT WITH CODE THAT INITIALIZES
10013BB8 push ecx ;THE KEY CONTAINED IN esp+600h+var_5DD
10013BB9 call ds:fopen ;TO ZERO AND INCREMENT IT AFTER EACH LOOP
10013BBF mov esi, eax ;IF THE SPACE IS NOT ENOUGH, MAKE A JUMP
10013BC1 add esp, 8 ;TO A ZERO ISLAND IN THE CODE AND PUT YOUR GENERATOR/INCREMENTING CODE
10013BC4 test esi, esi ;THERE, THEN JUMP BACK TO THE PALCE WHERE
10013BC6 jz loc_10013C53 ;THE KEY IS PUSHED TO THE STACK TO BE VALIDATED
10013BCC lea edx, [esp+5F0h+var_5D8] ; I.E. 10013BE4
10013BD0 push edx ;IF VALIDATION AT 10013BFD FAILS, LOOP TO THE GENERATOR
10013BD1 push offset aLf ; "%lf" ; INCREMENT THE KEY
10013BD6 push esi
10013BD7 call ds:fscanf ; <--- READ LONG DOUBLE FROM FILE
10013BDD push esi
10013BDE call ds:fclose
10013BE4 lea eax, [esp+600h+var_5DD]
10013BE8 lea ecx, [esp+600h+var_5DA]
10013BEC push eax
10013BED mov eax, [esp+604h+var_5D4]
10013BF1 lea edx, [esp+604h+var_5DC]
10013BF5 push ecx
10013BF6 mov ecx, [esp+608h+var_5D8]
10013BFA push edx
10013BFB push eax
10013BFC push ecx
10013BFD call sub_100139E0 ; <--- THE CHECKING FUNCTION
10013C02 mov al, [esp+614h+var_5DD]
10013C06 add esp, 24h
10013C09 test al, al ; <--- CHECK IF RETURN IS CORRECT (?); IF AL,AL IS TRUE, JUMP TO A CODE THAT REPORT
10013C0B jz short loc_10013C2E ;THE CONTENTS OF THE KEY, OR EVEN SIMPLY BREAK
10013C0D call dword_1001F9AC ;SOFTICE, AND YOU CAN RETRIEVE THE CONTENTS OF THE
10013C13 cmp ax, [esp+5F0h+var_5DC] ; KEY MANUALLY.
10013C18 jnz short loc_10013C2E ;OTHERWISE, CHANGE THE INSTRUCTION IN 10013COD TO
10013C1A mov dx, [ebp+arg_4] ;JMP TO THE GENERATOR, CLOSING THE LOOP.
10013C1E cmp [esp+5F0h+var_5DA], dx
10013C23 jnz short loc_10013C2E
10013C25 mov al, 1
10013C27 pop edi
10013C28 pop esi
10013C29 pop ebx
10013C2A mov esp, ebp
10013C2C pop ebp
10013C2D retn


HOPE THIS HELPS

Yeah, thanks, that helped a lot!

BTW, is there a convenient way of reporting some register content with a few ops? OK, I could call an int 3 and use SICE, but writing it to a file or something similar (MessageBox) would be very nice.

Any ideas?

Not in a few ops.

the convoluted part is to change a double into a null terminated string, which is the data type that a messagebox wants. Writing to a file will also involve creating, then writing then closing, which may require more than a few push and calls.

It can be done, of course, but IMHO would require too much coding and debugging for a quicky brute force project.