. . t h e ú w h i z ú k i d ú p r o u d l y ú p r e s e n t s . .

ÜÜÜÜÜÜ               ÜÜÜÛßßßßÛÜ     ÜÜÜÜÜ         ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ
ß ÜÜ ÛÜ  ÜÛßßßßÛ  ÜÛßß ÜÜ ÛÛÜ Û   ÜÛß Ü ßÛ     ÜÛßß Ü² ßß ÜÜ ßß Ü ßÛßßßÛÜ
ßÛÛ²Ü ßÛ Û ÜÛ² ßÛ Û ÜÛ²ß  ÛÛÛ Û   Û Ü²²ß ÛÜÜÜÜÜÛ ÜÛÛÛÛ  ßßÛ²ß Ü²²ß  ÜÛÜ ßÛÜÜ
Ü ßÛÛÛ ßÛÛ ÛÛÛ² ßÛÛ ÛÛß Û ÛÛ² ÛßßßßÜ ßÜ þÜÜÜÜÜÜÜ   Û²Û ß Ü²  Ü ßÜ  ßÛÛÛÛÜÜ ßßÛÜ
ßÛ ßÛÛ² ß ÜÛÛÛÛ² ß Ü²ß ÛÛ ÛÛ²  ÜÛÛÜ ÜÛÛÜ ßßÛÛÛÛ ÜÛ ÛÛÛÜÛÛß ÜÛ ÜÛÛÜ ÜÜ ßßßÛÛ²Ü ß
 ßÛ ßÛÛ² Ü²ß ÛÛÛ² Ü²ß ÛßÛ ÛÛÛÜÛßÛÛÛ  ÛÛÛ Û  ܲ ÜÛÛ ÛÛ²ßÛÛÛ ßÛÜ ÛÛ² ß ÜÛ Ü ßÛÛ²ß
  ßÛ ßÛÛÜÛß Ü ÛÛÛÛÛ² Ûß Û ÛÛ²ß Ü Û²Ü ÛÛ²  Ü²ß  ßßÛ ÛÛÛ  ÛÛ²Ü ß ÛÛ²  ÛÛ² ßß Û² Ü
   ßÛ ÛÛÛÛ ÛÛÜ ÛÛÛ² ÜÛ  Û Û² ÜÛÛ ²Ûß Û²ß ÛÛÛÛÜÜß Û ÛÛß Ü ßÛÛ²Ü ÛÛß  ßÛÛÛÜÜÛß ÜÛ
    ÛÜ ßß ÜÛ ÛÜ Ûß ÜÛ   Û Û ÜÛ Û ß Ü ß Ü ßßßßß ÜÛÛ ß ÜÛßÛ ßÛß  ß ÜÛÛÜ ßßß ÜÜÛß
     ßßßßßß   ÛÜÜÜÛß    ÛÜÜÜÛ  ßßßßßßßßßßßßßßßßß ßßßßß  ßÛÜÜÜÛßßßß  ßßßßßßß



Cracking in 2 methods
---------------------

Target: c4n's 3rd crackme made by Kwai_Lo and ytc. 


1. dead listing - patching the program to accept ant serial entered
2. Live cracking - Finding the correct serial generated to the name

Method 1
--------

Tools used:

W32dasm
HIEW (Hacker's View)

Lets rock.

Open up the crackme, enter any name you want (my case WhizKiD), and any serial (12341234).
Click OK, and you get the message "Wrong Number!!". Open up W32dasm and dissassemble the 
crackme. Click on the strn ref button (better known as string data refrence), and find the
string "Congratualtions!!". Click on it, and you should be here now:

* Possible StringData Ref from Data Obj ->"Good!"
                                  |
:00401119 685C504000              push 0040505C

* Possible StringData Ref from Data Obj ->"Congratulations!!"
                                  |
:0040111E 6848504000              push 00405048
:00401123 53                      push ebx

This is where the user get prompted if he entered the correct serial. scroll up a bit,
until you see this :

:00401117 751B                    jne 00401134

Jne in asm means "Jump is Not Equal", so we have to change it to JE (=Jump if Equal),
so it would 'jump' to the registration box, even if the entered serial is wrong.
Look at the offset of the line: 1117h, but we dont need the h so the offset is 1117.

Open up Hiew and select the crackme. press F4 and choose decode mode. now you are back
in the asm of the app. click F5 (=goto), and type the offset. you should be back at the 
line of jne.

00401117: 751B         jne 000401134

Press F3 (=edit) and change the 75 to 74. Press F9 to update and F10 to quit.


Method 2
--------

Tools used:
Softice 3.xx or higher

Lets rock again.

Open the crackme and type Ctrl+D. Softice set a breakpoint on "getdlgitemtexta".
now enter any name/serial. I entered WhizKiD and serial 12341234.
Click OK, and you are back in Si. Press Ctrl+D once more, because there were 2
text boxes. Now you are in the function of the second text box.
Click F10 and trace until you see:

Cmp Ecx, Eax.

Type "? eax" and you see "12341234"
Type "? ecx" and you see the correct serial.

Hope you understood something :)


-WhizKiD