Author seifer666
Target Esquire Trial Crackme
Public Release  06/30/2000
Author Contact seifer666@caramail.com
Dedication n/a
Difficulty Level (1..7) 1 (EASY)
Tools Required SoftIce 3.xx.+
 

Disclaimer: Please note, the information herein is copyright to Hellforge. No portion of this text may be duplicated. Furthermore, damage or problems arising after reading this text is left to the users disposal. Neither Hellforge, nor its members can be held responsible for any direct or indirect result of following this text. The full liability of following this text is on the reader (YOU). The information is provided for educational purposes, misuse of this information is strictly prohibited. If you do not agree with this agreement, then please hit the "back" button on your browser, and go to hell. - Mercution.
 

Introduction
 

N/A
 

Tutorial
 

This time, it's a name/serial protection... To crack this, you just have to find your serial. Launch the prog. I enter my name and a fake serial (seifer666/12345). Pop up SIce, and put a bpx on hmemcpy. Press F5 and validate ur serial. SIce comes back. Then press 10 times F5 in order to arrive at the good code location. Press 7 times F12 to be in the prog process. Finally, press F10 until you arrive at :
 

:00441141 E84A10FEFF              call 00422190 ;you exited this call
:00441146 8B55F4                  mov edx, dword ptr [ebp-0C] ;moves the fake serial into edx
:00441149 8B45FC                  mov eax, dword ptr [ebp-04] ;moves the good serial into eax
:0044114C E8F329FCFF              call 00403B44 ;simple comparison routine
:00441151 7524                    jne 00441177 ;if you entered a bad serial, jmp to motherfucker =)


When you arrive at offset 44114C, type d edx, and you'll see our fake serial. Type d eax and you'll see 958884567, which is the good serial. Clear the breakpoint and try your serial. Hehe it's the good one. Another one cracked ! But don't u think it is a little too easy to say that we are the best crackers of the world because we just found a serial :p ? Let's keygen this in C...
 


 
The keygen

Well I'm a in a hurry, so i'll just explain how the serial is calculated and give my keygen source code. By tracing under Sice, we find the following algo :


*Length of the name has to be greater than 0.
*For each char of the name, do : 
	*Take its ascii code
	*Divides it by 3
	*Adds the position of the char 
	*Takes the rest of the euclidian division of the former number by 10
	*Adds 48 to the rest
	*This final number is converted to char
	*All the obtained chars form the serial
And now, the source code in C :
 


*************************************************************************************************
//Esquire Trial Crackme Keygen written by seifer666

#include < stdio.h >
#include < conio.h >
#include < string.h >





int main()
{


	char name[100]; //name
	char serial[100];//serial
	int len, i; //length of name, position of the char of the name
	int count = 1; //counter



	//let's it look pretty =)
	printf("*************************************************\n");
	printf("	  Esquire Trial Crackme Keygen         \n");
	printf("    Written by seifer666 under Visual C++ 6.0      \n");
	printf("*************************************************\n");


	printf("\nEnter your name : ");
	gets(name);
	len = strlen(name);

	if(len == 0) //no name entered ?
	{
		printf("\nYou gotta enter your name !!");
		getch();
		return 1; //error returned
	}
	

//THE KEYGEN OF THE DEATH
	

	for(i=0;i < len;i++) //for each chars of the name
	{

		serial[i] = name[i] / 3; //divides the ascii code by 3
		serial[i] += count; //adds the position of the char to it
		serial[i] %= 10; //takes the rest by dividing it by 10 (serial[i] modulo 10)
		serial[i] += 48; //adds 48 to it
		count++; //next char
	}

	
	serial[i] = 0x00; //we just want the serial and not the other dword shits
	

	printf("\nYour registration code is : %s", serial);//%s = string
	getch();
	return 0; //everything is ok

}

*************************************************************************************************

 

 
Final Thoughts
 

Well it's done :p ! I hope u understood the whole thing, but i'm in a hurry. So if u don't find the algo or sth else, please contact me.


 

Greetings to...
 

I greet my groups : DQF, digital Factory, HellForge

and my friends (no specific order) : ACiD BuRN, BoomBox, BlndAngl, Lucifer48, Volatility, Tscube, Visionz, amante4, alpine, FatBoyJoe, Warez Pup, Eternal_bliss, r!sc, [mega], Sushi, MagicRaphoun, TaMaMbolo, Kahel,V-Rom, Ep-180, morrinth, Tres`ni, Dawai, DXF, CiniMod, xor, Air2k, grAnix, LordOfLa, karlitoXZ, [ManKind], Falcon^, Dazzler.... and all I've forgotten ;-)

You can join me at seifer666@caramail.com or #ICQ : 61545376


 

The end.
Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.