Author	seifer666
Target	Cream2000 VB Crackme1
Public Release	08/08/2000
Author Contact	seifer666@caramail.com
Dedication	Mercution for his good work
Difficulty Level (1..7)	1 (EASY)
Tools Required	Smart Check 6.0, Visual Basic 4 or more for the keygen

 

Disclaimer: Please note, the information herein is copyright to Hellforge. No portion of this text may be duplicated. Furthermore, damage or problems arising after reading this text is left to the users disposal. Neither Hellforge, nor its members can be held responsible for any direct or indirect result of following this text. The full liability of following this text is on the reader (YOU). The information is provided for educational purposes, misuse of this information is strictly prohibited. If you do not agree with this agreement, then please hit the "back" button on your browser, and go to hell. - Mercution.
 

Back from holidays, I got this pretty crackme which gives a strange serial...
 

This time we will see another type of serials : real numbers. For my part, it is the first time I crack such serials, I find it very strange to user numbers with floating point, maybe they thought it would be more difficult to crack... In fact, it doesn't change anything and the Keygen for this crackme is one line long, if we don't count the sub declaration and the end sub line. Launch the crackme with Smart Check, enter your name and a fake serial (seifer666/12345). Click on the button and exit the prog. Let's look at Smart Check's log. We see one event, _Click. By looking inside this event we find :
 

*Cos(double:76) returns double 0,824331 (displayed as single-precision floating point)
*Len(String"seifer66..." returns LONG:9
*Str(VARIANT:Double:422.822)
*Cos(double:76) returns double 0,824331 (displayed as single-precision floating point)
*Len(String"seifer66..." returns LONG:9
*Str(VARIANT:Double:422.822)
*MsgBox(VARIANT:String:"Sorry, t...", Integer:0, VARIANT:Missing, VARIANT:Missing, VARIANT:Missing) returns Integer:1

There's something i don't understand. I wonder why the routine does twice the same serial calculation... Maybe is it a verification. This is not our problem btw. We just have to find the serial. Click on line : *Str(VARIANT:Double:422.822), and u'll see in the right window of SC :

number(variant)
	.
	.
	....double.dblVal =  422.8819728581771

By playing a little with the numbers, we find that :

422.88197285817717 / cos(76) = 513, where 76 is a number in radians, and 513 = 57 * 9, knowing that the length of the name is 9.

I repeated the calculations for several lengths of names and obtained the Keygen algo :

serial = cos(76) * 57 * length(name), which gives in VB :
 

*************************************************************************************************
Private Sub text1_change()

Text2.Text = Str((Cos(76)) * 57 * Len(Text1.Text))

End Sub
*************************************************************************************************

Heh, when I told u that he Keygen would be short, I didn't lie...  cya soon for another tutorial brought to u by Hellforge !

I greet my knowledge sharing group : HellForge

and my friends (no specific order) : ACiD BuRN, BoomBox, BlndAngl, Lucifer48, Volatility, Tscube, Visionz, amante4, alpine, FatBoyJoe, Warez Pup, Eternal_bliss, r!sc, [mega], Sushi, MagicRaphoun, TaMaMbolo, Kahel, V-Rom, Ep-180, morrinth, Tres`ni, Dawai, DXF, CiniMod, xor, Air2k, grAnix, LordOfLa, karlitoXZ, [ManKind], Falcon^, Dazzler, Lazarus, AbsoluteB, JB007, C_DKnight, Miscreant, Crudd, kanabis, Cell-, BMonkey, Armour, Vylent, Skamer, Fenorez, sinn0r, Dark Wolf, Bishop, Mercution, AC_178.... and all I've forgotten ;-)