EditPlus is a text/HTML editor. I have cracked the version 1.20 and 1.21. The
protection of version 1.22 is slightly changed.I will explain how to make a
key generator for v1.22.
URL: http://www.editplus.com
The author is very clever. He checks your registration code at completely
different places.The first check is done before it exits,while the second check
is done when it is lanuched.
Just use "bpx GetWindowTextA" as your breakpoint after you enter your fake
serial.Set a BPR on any occurence of your fake serial in the memory.Finally you
will find that your fake serial is moved to the buffer at 004EA878 if the length
of it is 0x11. This is a global byte array(from DS:004EA878 to DS:004EA888).
Let's denote this array with
char serial[0x11]="12345678-87654321"; /* my fake serial */
First it will check serial[4]:
:00420F6B 8B1590A84E00 mov edx, dword ptr [004EA890]
:00420F71 0FBE02 movsx eax, byte ptr [edx] ;First char of name
:00420F74 8D440010 lea eax, dword ptr [eax+eax+10]
:00420F78 99 cdq
:00420F79 33C2 xor eax, edx
:00420F7B 2BC2 sub eax, edx
:00420F7D 83E00F and eax, 0000000F
:00420F80 33C2 xor eax, edx
:00420F82 2BC2 sub eax, edx
:00420F84 83F80A cmp eax, 0000000A
:00420F87 A348A84E00 mov dword ptr [004EA848], eax
:00420F8C 7D04 jge 00420F92
:00420F8E 0430 add al, 30
:00420F90 EB02 jmp 00420F94
:00420F92 0437 add al, 37
:00420F94 3A057CA84E00 cmp al, byte ptr [004EA87C] ;check serial[4]
:00420F9A 740A je 00420FA6
:00420F9C C705101D4E0000000000 mov dword ptr [004E1D10], 00000000 ;bad flag
From the above code,we know how it calculates the correct serial[4].
Then it will check my fake serial[5]:
:004588C3 A1101D4E00 mov eax, dword ptr [004E1D10];Is bad flag set?
:004588C8 85C0 test eax, eax
:004588CA 7444 je 00458910 ; jump if bad guy
:004588CC A190A84E00 mov eax, dword ptr [004EA890]
:004588D1 8B0D94A84E00 mov ecx, dword ptr [004EA894]
:004588D7 0FBE4401FF movsx eax, byte ptr [ecx+eax-01];The last char
;of name
:004588DC 83C007 add eax, 00000007
:004588DF 8D0480 lea eax, dword ptr [eax+4*eax]
:004588E2 99 cdq
:004588E3 33C2 xor eax, edx
:004588E5 2BC2 sub eax, edx
:004588E7 83E00F and eax, 0000000F
:004588EA 33C2 xor eax, edx
:004588EC 2BC2 sub eax, edx
:004588EE 83F80A cmp eax, 0000000A
:004588F1 A34CA84E00 mov dword ptr [004EA84C], eax
:004588F6 7D04 jge 004588FC
:004588F8 0430 add al, 30
:004588FA EB02 jmp 004588FE
:004588FC 0437 add al, 37
:004588FE 3A057DA84E00 cmp al, byte ptr [004EA87D] ;check serial[5]
:00458904 740A je 00458910
:00458906 C705101D4E0000000000 mov dword ptr [004E1D10], 00000000;bad flag
It will continue to check serial[6]:
:0045CE60 0FBE3C30 movsx edi, byte ptr [eax+esi];get a char from
;my name
:0045CE64 03CF add ecx, edi ;add it
:0045CE66 40 inc eax
:0045CE67 3BC2 cmp eax, edx
:0045CE69 890D50A84E00 mov dword ptr [004EA850], ecx
:0045CE6F 7CEF jl 0045CE60 ; continue loop
:0045CE71 8D4106 lea eax, dword ptr [ecx+06]
:0045CE74 8D0440 lea eax, dword ptr [eax+2*eax]
:0045CE77 99 cdq
:0045CE78 33C2 xor eax, edx
:0045CE7A 2BC2 sub eax, edx
:0045CE7C 83E00F and eax, 0000000F
:0045CE7F 33C2 xor eax, edx
:0045CE81 2BC2 sub eax, edx
:0045CE83 83F80A cmp eax, 0000000A
:0045CE86 A350A84E00 mov dword ptr [004EA850], eax
:0045CE8B 7D04 jge 0045CE91
:0045CE8D 0430 add al, 30
:0045CE8F EB02 jmp 0045CE93
:0045CE91 0437 add al, 37
:0045CE93 3A057EA84E00 cmp al, byte ptr [004EA87E];check serial[6]
:0045CE99 740A je 0045CEA5
:0045CE9B C705101D4E0000000000 mov dword ptr [004E1D10], 00000000 ;bad flag
It continus to check serial[14]:
:0045E61E A1101D4E00 mov eax, dword ptr [004E1D10]
:0045E623 85C0 test eax, eax
:0045E625 7449 je 0045E670
:0045E627 8B0D90A84E00 mov ecx, dword ptr [004EA890]
:0045E62D 8B1594A84E00 mov edx, dword ptr [004EA894]
:0045E633 0FBE4C0AFF movsx ecx, byte ptr [edx+ecx-01]
:0045E638 8BC1 mov eax, ecx
:0045E63A C1E003 shl eax, 03
:0045E63D 2BC1 sub eax, ecx
:0045E63F 83E805 sub eax, 00000005
:0045E642 99 cdq
:0045E643 33C2 xor eax, edx
:0045E645 2BC2 sub eax, edx
:0045E647 83E00F and eax, 0000000F
:0045E64A 33C2 xor eax, edx
:0045E64C 2BC2 sub eax, edx
:0045E64E 83F80A cmp eax, 0000000A
:0045E651 A36CA84E00 mov dword ptr [004EA86C], eax
:0045E656 7D04 jge 0045E65C
:0045E658 0430 add al, 30
:0045E65A EB02 jmp 0045E65E
:0045E65C 0437 add al, 37
:0045E65E 3A0586A84E00 cmp al, byte ptr [004EA886];check serial[14]
:0045E664 740A je 0045E670
:0045E666 C705101D4E0000000000 mov dword ptr [004E1D10], 00000000
Then it will check the length of my fake serial:
:004502E0 A1101D4E00 mov eax, dword ptr [004E1D10];Is bad flag set?
:004502E5 85C0 test eax, eax
:004502E7 741A je 00450303 ;jump if bad guy
:004502E9 6878A84E00 push 004EA878
* Reference To: KERNEL32.lstrlenA, Ord:02A1h
|
:004502EE FF156CB24B00 Call dword ptr [004BB26C]
:004502F4 83F811 cmp eax, 00000011 ;check the length
:004502F7 740A je 00450303
:004502F9 C705101D4E0000000000 mov dword ptr [004E1D10], 00000000 ;bad flag
After this,it exits. If you think that you have passed all the checks,you
are wrong ! Use SoftICE symbol loader to load the program,type
"bpr 004EA878 004EA888 rw" to set a breakpoint.(Of course you can use other
breakpoints such as BPX RegQueryValueExA etc.But mine is the best.How do I know
this ? Because I have cracked its older version! )
Press F5 to proceed,you can see your fake serial is read from windows
registry,and finally is moved to the buffer at DS:004EA878.
First it will check serial[0]:
:00458934 A1101D4E00 mov eax, dword ptr [004E1D10];Is bad flag set?
:00458939 85C0 test eax, eax
:0045893B 743D je 0045897A ;jump if bad guy
:0045893D 8B0D90A84E00 mov ecx, dword ptr [004EA890]
:00458943 0FBE01 movsx eax, byte ptr [ecx];First char of name
:00458946 83C005 add eax, 00000005
:00458949 8D0440 lea eax, dword ptr [eax+2*eax]
:0045894C 99 cdq
:0045894D 33C2 xor eax, edx
:0045894F 2BC2 sub eax, edx
:00458951 83E00F and eax, 0000000F
:00458954 33C2 xor eax, edx
:00458956 2BC2 sub eax, edx
:00458958 83F80A cmp eax, 0000000A
:0045895B A338A84E00 mov dword ptr [004EA838], eax
:00458960 7D04 jge 00458966
:00458962 0430 add al, 30
:00458964 EB02 jmp 00458968
:00458966 0437 add al, 37
:00458968 3A0578A84E00 cmp al, byte ptr [004EA878]; check serial[0]
:0045896E 740A je 0045897A
:00458970 C705101D4E0000000000 mov dword ptr [004E1D10], 00000000;bad flag
It will then check serial[1]:
:0045055F A1101D4E00 mov eax, dword ptr [004E1D10];Is bad flag set?
:00450564 85C0 test eax, eax
:00450566 7445 je 004505AD
:00450568 8B0D90A84E00 mov ecx, dword ptr [004EA890]
:0045056E 8B1594A84E00 mov edx, dword ptr [004EA894]
:00450574 0FBE440AFF movsx eax, byte ptr [edx+ecx-01];The last char
:00450579 83C002 add eax, 00000002
:0045057C 8D04C0 lea eax, dword ptr [eax+8*eax]
:0045057F 99 cdq
:00450580 33C2 xor eax, edx
:00450582 2BC2 sub eax, edx
:00450584 83E00F and eax, 0000000F
:00450587 33C2 xor eax, edx
:00450589 2BC2 sub eax, edx
:0045058B 83F80A cmp eax, 0000000A
:0045058E A33CA84E00 mov dword ptr [004EA83C], eax
:00450593 7D04 jge 00450599
:00450595 0430 add al, 30
:00450597 EB02 jmp 0045059B
:00450599 0437 add al, 37
:0045059B 3A0579A84E00 cmp al, byte ptr [004EA879]; check serial[1]
:004505A1 740A je 004505AD
:004505A3 C705101D4E0000000000 mov dword ptr [004E1D10], 00000000;bad flag
Then it will check serial[2]:
:0045CA4E 0FBE3C30 movsx edi, byte ptr [eax+esi];get a char
:0045CA52 03CF add ecx, edi
:0045CA54 40 inc eax
:0045CA55 3BC2 cmp eax, edx
:0045CA57 890D40A84E00 mov dword ptr [004EA840], ecx
:0045CA5D 7CEF jl 0045CA4E ;loop
:0045CA5F 8D4108 lea eax, dword ptr [ecx+08]
:0045CA62 8D0440 lea eax, dword ptr [eax+2*eax]
:0045CA65 D1E0 shl eax, 1
:0045CA67 99 cdq
:0045CA68 33C2 xor eax, edx
:0045CA6A 2BC2 sub eax, edx
:0045CA6C 83E00F and eax, 0000000F
:0045CA6F 33C2 xor eax, edx
:0045CA71 2BC2 sub eax, edx
:0045CA73 83F80A cmp eax, 0000000A
:0045CA76 A340A84E00 mov dword ptr [004EA840], eax
:0045CA7B 7D04 jge 0045CA81
:0045CA7D 0430 add al, 30
:0045CA7F EB02 jmp 0045CA83
:0045CA81 0437 add al, 37
:0045CA83 3A057AA84E00 cmp al, byte ptr [004EA87A] ;check serial[2]
:0045CA89 740A je 0045CA95
:0045CA8B C705101D4E0000000000 mov dword ptr [004E1D10], 00000000;bad flag
It will continue to check serial[9]:
:00449C8F A1101D4E00 mov eax, dword ptr [004E1D10]
:00449C94 85C0 test eax, eax
:00449C96 743A je 00449CD2 ;jump if bad guy
:00449C98 A190A84E00 mov eax, dword ptr [004EA890]
:00449C9D 0FBE08 movsx ecx, byte ptr [eax] ;First char of name
:00449CA0 8D440907 lea eax, dword ptr [ecx+ecx+07]
:00449CA4 99 cdq
:00449CA5 33C2 xor eax, edx
:00449CA7 2BC2 sub eax, edx
:00449CA9 83E00F and eax, 0000000F
:00449CAC 33C2 xor eax, edx
:00449CAE 2BC2 sub eax, edx
:00449CB0 83F80A cmp eax, 0000000A
:00449CB3 A358A84E00 mov dword ptr [004EA858], eax
:00449CB8 7D04 jge 00449CBE
:00449CBA 0430 add al, 30
:00449CBC EB02 jmp 00449CC0
:00449CBE 0437 add al, 37
:00449CC0 3A0581A84E00 cmp al, byte ptr [004EA881] ; check serial[9]
:00449CC6 740A je 00449CD2
:00449CC8 C705101D4E0000000000 mov dword ptr [004E1D10], 00000000
Finally it checks serial[8]:
:00449F09 391D101D4E00 cmp dword ptr [004E1D10], ebx
:00449F0F 7429 je 00449F3A
:00449F11 803D80A84E002D cmp byte ptr [004EA880], 2D ;Is it '-' ?
:00449F18 7411 je 00449F2B
:00449F1A 891D101D4E00 mov dword ptr [004E1D10], ebx ;set a bad flag
So many redundant instructions !
The other chars of my fake serial are not exactly checked.
We can write a key generator for it now.
Here is the partial source code(compiled with VC++):
char UserName[80];
char RegCode[]="00000000-00000000";
long tmp[17]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,};
char LastChar;
long sum;
GetDlgItemText(hDlg,IDC_USERNAME,UserName,sizeof(UserName));
if(UserName[0]=='\0')
{ SetDlgItemText(hDlg,IDC_REGCODE,"");
return FALSE;
}
_asm
{
push eax
push ecx
push edx
push esi
push edi
mov esi,offset (UserName[0])
xor eax,eax
add_it: movsx ecx,byte ptr [esi]
test ecx,ecx
jz end_loop
add eax,ecx
inc esi
jmp add_it
end_loop: mov [sum],eax
dec esi
mov al,[esi]
mov [LastChar],al
movsx eax, byte ptr (UserName[0])
lea eax, dword ptr [eax+eax+0x10]
mov [tmp+16],eax
movsx eax, byte ptr [LastChar]
add eax, 00000007
lea eax, dword ptr [eax+4*eax]
mov [tmp+20],eax
mov ecx,[sum]
lea eax, dword ptr [ecx+6]
lea eax, dword ptr [eax+2*eax]
mov [tmp+24],eax
movsx ecx, byte ptr [LastChar]
mov eax, ecx
shl eax, 3
sub eax, ecx
sub eax, 5
mov [tmp+56],eax
movsx eax, byte ptr (UserName[0])
add eax, 5
lea eax, dword ptr [eax+2*eax]
mov [tmp],eax
movsx eax, byte ptr [LastChar]
add eax, 2
lea eax, dword ptr [eax+8*eax]
mov [tmp+4],eax
mov ecx,[sum]
lea eax, dword ptr [ecx+8]
lea eax, dword ptr [eax+2*eax]
shl eax, 1
mov [tmp+8],eax
movsx ecx, byte ptr (UserName[0])
lea eax, dword ptr [ecx+ecx+7]
mov [tmp+36],eax
mov esi,offset (tmp[0])
mov edi,offset (RegCode[0])
xor ecx,ecx
make_key: mov eax,[esi]
cdq
xor eax, edx
sub eax, edx
and eax, 0x0000000F
xor eax, edx
sub eax, edx
cmp eax, 0x0000000A
jge IsHexDigit
add al, 0x30
jmp continue_it
IsHexDigit: add al, 0x37
continue_it: mov [edi],al
add esi,4
inc edi
inc ecx
cmp ecx,16
jle make_key
pop edi
pop esi
pop edx
pop ecx
pop eax
}
RegCode[8]='-';
SetDlgItemText(hDlg,IDC_REGCODE,RegCode);
That's all. Thank you.