Welcome to Cracking Tutorial #94! Hiya guys, Sorry for delays, again I was busy with coding and all shit... Here's a tut94.tKC... OK, let's rave! ...or crack babes? :) You'll need the following tools: (I use these tools, I assume you'll use 'em, but it doesn't mean that you'll need to use all those tools, so be sure to get them handy for the examples in this tutorial!) SoftICE v4.05 W32Dasm v8.93 Hacker's View v6.55 SmartCheck v6.03 ProcDump32 v1.6.2 TRW2000 v1.22 IDA v4.04 Windows Commander v4.51 (I use it coz of easier to multitask) Delphi, VB, C++, or TASM to code a keygen or a patch.. Don't ask me where to download all these tools since you had a chance to get them when you used my older tutorials. Here are a few good sites where you can grab tools from: http://protools.cjb.net http://w3.to/protools http://www.crackstore.com or ask any crackers to get you these tools! Are you ready?! OK! ;) How to crack Easy CD-DA Extractor 4.2.0 build 15 Target: Easy CD-DA Extractor 4.2.0 WWW: http://www.poikosoft.com/cdda Cracker: --..__J_o_h_n_n_y__A_U_M__..-- Protections to be removed: begining nag, expiration Tools: Hiew, W32Dasm & Windows Commander 4.51 --------New infos: Silent Wars for gaining total control------- The theory behind silent wars was elaborated of 300 years ago by iudeo-masonery. Then was declared a total war against the masses of people around the Earth, because "they are so stupid & animalic that they must be conducted & manipulated in the direction we wish forever". This war was restart in modern age in 1989 and is the 3rd mondial war and is given in economical & menthal plane for conquering the whole world and to declare the begining of New World Order - - the worshipers of Satana Order - and must be finished around year 2035 or in the worst case in 2050(worst for these bastards). Fight hard against any abuse in human rights and autority abuses! Fight back instantly even with a process (trial) if necesarry! And don't give away your protection weapons! And also fight against governs who hides the high technology of new era! -------------------- Nice CD audio tracks grabber, this Easy CD-DA Extractor. From my many test results that in many cases is better than WinDac 1.52 and absolutely (in copying after audio CD I mean) better than Audio Catalyst 2.1. Ya, this results from tests; I really don't know why so many consider that Catalyst is so great; I agree, is great at wav -> mp3 encoding, but not on copying from CD. Anyway let's crack this 4.2.0 version; it's very easy to crack but I do this for attracting attention on this good grabber. If you deal with recording audio CD's it'a must! Now let's get over with it! 1. We see first nag, this with the words "Thank you for trying Easy CD...". Let's disassemble a copy of ezcddax.exe -> y.exe with W32Dasm. Let's search (Alt-S-Enter); I found them at w32dasm adress 4233FA and above, at line 4233F2 is je 423421, our jump. Let's modify this: hiew 229F2 - - 74 -> EB. We test now, and what do you know? Nag is gone forever. Good. Next. 2. Now we encounter some words in w32dasm about expiration, line 423393 jbe 4233EA (our jump) and words below: "This trial version has expired!". Let's modify for unexpiring: hiew 22993 - - 76 -> EB. A small test, funny nothing seems to expire... OK! 3. Optional: words from url (with blue characters): "Click here to buy the full version". I found that is nice to transform them in this: "Easy CD-DA extractor Homepage". OK in this way? Now hex is looking like this: 0019CDA8: 43 20 0019CDA9: 6C 20 0019CDAA: 69 45 0019CDAB: 63 61 0019CDAC: 6B 73 0019CDAD: 20 79 0019CDAE: 68 20 0019CDAF: 65 43 0019CDB0: 72 44 0019CDB1: 65 2D 0019CDB2: 20 44 0019CDB3: 74 41 0019CDB4: 6F 20 0019CDB5: 20 45 0019CDB6: 62 78 0019CDB7: 75 74 0019CDB8: 79 72 0019CDB9: 20 61 0019CDBA: 74 63 0019CDBB: 68 74 0019CDBC: 65 6F 0019CDBD: 20 72 0019CDBE: 66 20 0019CDBF: 75 20 0019CDC0: 6C 48 0019CDC1: 6C 6F 0019CDC2: 20 6D 0019CDC3: 76 65 0019CDC4: 65 70 0019CDC5: 72 61 0019CDC6: 73 67 0019CDC7: 69 65 0019CDC8: 6F 20 0019CDC9: 6E 20 Ok, all seems to be OK! Bye now, see you! ---------------- Greets: tKC & CIA (nice guys!), to all crackers, PRO or newbies, all cracker teams (keep going, we must eliberate from iudeo-masonic tirany, all must become free), we are great guys, and nice too. I love you all but be a good soul! Romanian Greets: Toate cele bune oamenilor inimosi din Romania! O sa vina si zile mai bune! Incercati sa evoluati spiritual daca vreti sa fiti fericiti! At last, but from all my heart: I love you Heavenly Father, I know you are with me all the time! God is pure love! Try this: www.geocities.com/john_aum Incredible infos for YOUR EYES ONLY! Critics, comments, anything at: johnny_aum@yahoo.com ---------------Sorry if my english is not perfect!------------------------------ How to keygen PC-Adreázz! v4.x ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by M.o.D. [F2F] tools used : - SoftIce 4.05 ( protools.cjb.net ) - Delphi 5 ( for the Keygen ) - pen & paper ( optional :) ) Ok, lets start! Click on "Extras" and "Registration". We see a nice Registerbox, where we can enter our name and serial. Press Ctr+D to fire up SI and set a breakpoint on Hmemcpy ( bpx hmemcpy ). Leave SI by pressing F5 and enter your name and as serial "1122334455". Press the OK-Button and we're back in SI. Press F5 and we break again on "Hmemcpy". The programm grabbed our name first and then our serial. Now press F12 14 times to go back to our target programm and then press F5 and trace to line "4834A5". You should see this code: 004834A5 E8FAC7FFFF call 0047FCA4 -> calculates key & checks them :) 004834AA 5A pop edx 004834AB 0AD0 or dl, al 004834AD 7422 je 004834D1 -> test if we're a good/bad user Now clear your breakpoints ( bc * ) and set one at the keycheck-call ( bpx 4834A5 ). Press F5 to leave SI and press the Ok-Button in the RegistrationBox again. We break at line "4834A5". Now press F8 to go inside the call. It's time to start understanding the keycalculation. In SI we're at line "47FCA4". I will save some time. That means we can set a breakpint at line "47FD22" ( bpx 47FD22 ). Here starts the real fun :)! Press F5 to leave SI and click on the OK-Button again. You should see the following code: 0047FD22 8B55FC mov edx, dword ptr [ebp-04] -> type "d edx" & you see "PCA21" 0047FD25 E8CA40F8FF call 00403DF4 0047FD2A 33DB xor ebx, ebx 0047FD2C 8B45EC mov eax, dword ptr [ebp-14] -> type "d eax" If you typed "d eax" at line "0047FD2C" you see in the Data-Window "PCA21[our name]". That means that our programm set "PCA21" for our name before the real key-calculation starts. So we can note as first part of the keygen: paste "PCA21" before our name! Now comes the real calculation ( sn & tmp are only for the explanation): 0047FD42 0FB64C01FF movzx ecx, byte ptr [ecx+eax-01] -> character from "PCA21[our name]" 0047FD47 03C9 add ecx, ecx -> tmp=ascii-value*2 0047FD49 8D0CC9 lea ecx, dword ptr [ecx+8*ecx] -> tmp=tmp*9 0047FD4C 03D9 add ebx, ecx -> sn=sn+tmp 0047FD4E 03D8 add ebx, eax 0047FD50 40 inc eax -> go to the next character 0047FD51 4A dec edx -> edx contains length from "PCA21+Name" 0047FD52 75EB jne 0047FD3F -> test if last character is reached Ok, here we see the calculation from the first part of our key: The programm takes the ascii-value from every character and multiplies the value with 18 and adds every result for each character together. The result is stored in EBX! Now we trace to line "0047FD71". We see this: 0047FD71 8DB3E0930400 lea esi, dword ptr [ebx+000493E0] -> add 300000 to EBX! Remember that EBX contains the result of the calculation above. The programms add 300000 to the result and we have the first part of the key :). The second part of the key is calculated at line "0047FD93". Code: 0047FD93 2D50850200 sub eax, 00028550 -> EAX contains first part of the key The programm subtracts 165200 from the first part of our key and we have the second part. Ok, we are nearly ready. First the programm puts a "-" between the to parts of the key ("-"first part"-"second part). Last part is that the programm puts "V4"+firswt letter before the two keyparts. Sound a little bit strange, therefor an example: name: M.o.D. ( you ) key : V4M-first part-second part (V4y-first part-second part) Yeah, thats it. Programm successfully cracked :)! Now comes the Delphi 5 source of the keycalculation: ////////////////////////////////////////// cut here ///////////////////////////////////////// procedure calculatekey; var i,sn,tmp : integer; name : String; begin //edit1.text contains the username if length(edit1.text)=0 then begin // error that no name was entered end; name:='PCA21'+edit1.text; sn:=0;tmp:=0; for i:=1 to length(name) do begin tmp:=ord(name[i])*18+i; sn:=sn+tmp; end; sn:=sn+300000; edit2.text:='V4'+edit1.text[1]+'-'+inttostr(sn)+'-'+inttostr(sn-165200); end; ////////////////////////////////////////// cut end ////////////////////////////////////////// For questions and/or comments mail me : MoD_f2f@gmx.net to be continued... cu M.o.D. ps: english isn't my mother tongue! òòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòò òò ____ __ __ òòáë òò / _/_ _ __ _ ___ ____/ /____ _/ / òò ëáë òò _/ // ' \/ ' \/ _ \/ __/ __/ _ `/ / òò ë ë òò /___/_/_/_/_/_/_/\___/_/ \__/\_,_/_/ òò ë ë òò ____ __ __ òò ë ë òò / __ \___ ___ _______ ___ ___/ /__ ____ / /____òò ë ë òò / /_/ / -_|_-"Rulez" | :0043F068 BABCF04300 mov edx, 0043F0BC :0043F06D E8DA48FCFF call 0040394C :0043F072 8D45F8 lea eax, dword ptr [ebp-08] * Possible StringData Ref from Code Obj ->"Kick the msgbox and add code to " ->"this exe to make the Button exit " ->"!" | :0043F075 BACCF04300 mov edx, 0043F0CC :0043F07A E8CD48FCFF call 0040394C :0043F07F 6A00 push 00000000 :0043F081 FF75FC push [ebp-04] ;'Rulez' :0043F084 FF75F8 push [ebp-08] ;'Kick the msgbox and add code to ...' :0043F087 6A00 push 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043F018(C) | * Reference To: user32.MessageBoxA, Ord:0000h | :0043F089 E83275FCFF Call 004065C0 ;call the messagebox! :0043F08E 33C0 xor eax, eax :0043F090 5A pop edx :0043F091 59 pop ecx :0043F092 59 pop ecx :0043F093 648910 mov dword ptr fs:[eax], edx Ok! so now what to do ?! we don't want the nag to come pissing us off and we want to redirect the button on our new added code... let's have a closer look near the messagebox and we see this: :0043F075 BACCF04300 mov edx, 0043F0CC :0043F07A E8CD48FCFF call 0040394C :0043F07F 6A00 push 00000000 :0043F081 FF75FC push [ebp-04] ;'Rulez' :0043F084 FF75F8 push [ebp-08] ;'Kick the msgbox and add code to ...' :0043F087 6A00 push 00000000 ;why not puting a jmp here ?(to our code area) * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043F018(C) | * Reference To: user32.MessageBoxA, Ord:0000h | :0043F089 E83275FCFF Call 004065C0 ;call the messagebox! :0043F08E 33C0 xor eax, eax Ok, we have to redirect before the nag is shown, so we will patch on the push 00... double click on the line ":0043F087 6A00 push 00000000 " and look the offset ... We got it , it is 3E487.Writte it down on a paper we will use it later! 2)Finding where we are gonna put the new code! Hexedit your file and go at the offset we have just found! Go at 3E487 and start scrolling down.we'r looking for free space (i.e: place full of '00') Scroll down 'till you see that: ---------------------- Snip -------------------------------------- 0003E6D0 008B 15CC EE43 00E8 6CE5 FFFF A1D8 0B44 .....C..l......D 0003E6E0 008B 00E8 E0E5 FFFF E88F 44FC FF8D 4000 ..........D...@. 0003E6F0 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0003E700 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0003E710 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0003E720 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0003E730 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0003E740 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0003E750 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0003E760 0000 0000 0000 0000 0000 0000 0000 0000 ................ ---------------------- Snip -------------------------------------- As you can see , we started to scroll down at 3E487 and we can see a place full of 00 not so far of it! Good... So, where to add our code ? i propose the offset 3E700... Ok , we will add new code at 3E700! and we will call this location with a jmp! we already have the jmp emplacement! let's Rock :) Good , we know where to put the jump , and where it must go! but hell, in soft ice we can't put "jmp 3E487" so how to have the good place ?! Easy.. Fire up procdump and use the PE editor! open our target and look the 1st section Here , it's .Code... We need some value like : virtual offset , Raw offset. Here comes the formula: Good place in memory = Imagebase + Virtual offset + offset we found - Raw offset (note for dummies: use the windows calculator in scientist mode and select hex!) give us: 400000 + 1000 + 3E700 - 400 = 43F300 Goody eheh! we got it :) 3)Setting the jump! With your hexeditor go at 3E487 ( the place we will use to redirect...) and put a CC (int3) we will use this to break at the good place in soft ice (there are several ways to break though) Ctrl+D and sice is back :) put a "Bpint 3" and press F5 (Bpint 3 = break point on int 3h) Run our target and we are back in soft ice! you don't have to type the ' '. Now enter 'A' and press 'enter'. enter : 'jmp 43F300' press enter you now see the hex of this jmp.It is "E9 74 02 00 00" writte them down and now do this : A eip "enter" jmp eip "enter" F5 this will make the app loop in memory... You may wonder why i do this. It is simple. we redirected the app on a location filled with '00' and it was gonna Crash like hell ehe! We didn't patch the file yet , so better to make a infinite loop in memory and then kill the process using Procdump! Run procdump , right click on our target in the process list and click on 'kill Process'. Done! process killed , no crash and we have the opcode of the jump! Life is great heheh! Now, we go back in our hex editor and we go at the offset where we are going to put the jump (3E487).we see: CC00E83275FCFF ( originally it was : 6A00E83275FCFF). CC = int 3 remember ?! hehe So we patch here: CC00E83275 become E974020000 ( the opcode we found with soft ice!) Save your exe now! But don't run it , else it will crash miserably! Still because of the redirection to '00' place! 4)Adding the NEW code :) ok , the final part is to add the new code! We have a free emplacement , but it just has '00'. Here will come the code to add! ermmmm, what the hell are we going to add to make it close the process ?! hehe, time to be back in Wdasm and look for kernel32.ExitProcess in 'import references' found it ? ok double click on it and we land here : * Referenced by a CALL at Address: |:00403859 | * Reference To: kernel32.ExitProcess, Ord:0000h | :0040122C FF2564214400 Jmp dword ptr [00442164] <-- hmm , intresting! :00401232 8BC0 mov eax, eax let's have a look at 403859: * Reference To: kernel32.ExitProcess, Ord:0000h | :00403859 E8CED9FFFF Call 0040122C <-- it calls the exitprocess function... ok, it is enough for us ;) we will use the line : 0040122C FF2564214400 Jmp dword ptr [00442164] writte down the opcode on a paper: FF2564214400 now , back in the hex editor and go to the offset where we are going to add some code :) 0003E700 0000 0000 0000 0000 0000 0000 0000 0000 ................ you see this! 1st before writting the code of the jump to the exitprocess function we have to put a 'push 00'! opcode is '6A00' so it becomes: 0003E700 6A00 FF25 6421 4400 0000 0000 0000 0000 j..%d!D......... (for dummies: 000000000000 become FF2564214400) Save your target and run it... Press the button and enjoy! WOW! it closed the fucker :) hehe we did it , the button doesn't show us that ugly messagebox but exit the app instead! Rulez :) This tutorial is over and i hope you learnt something from it... I don't think it is too hard to understand for the newbies too Anyway , as i don't have internet anymore, don't mail me your question coz i don't know when i would read them! But Go on #Cracking4newbies and go nag an OP there ;-Ý i don't say nick of the ones who can help you hehe, i don't wanna have some problems :) But , if you want to send feedbacks , no problem! just do it :) hehehe This tutorial is dedicated to my girly! Celine , you own me!:) Greets fly out to: no specific order) CyberBlade,R!SC , ^INFeRNo^ , AB4DS , Klefz , Volatility , TORN@DO , T4D , Jeff , [Virus] , JaNe , Appbusta , Duelist , tKC , BuLLeT , Lucifer48 , MiZ , DnNuke , Bjanes , Skymarshall , afkayas , elmopio , SiFLyiNG , Fire Worx , CrackZ , neural_en , WarezPup , _y , SiONIDE , SKORPIEN , Lazarus , Eternal_Bliss , Magic Raphoun , DEZM , Bisoux , Carpathia , K17 , theMc , noos , Xmen , TeeJi , JB007 , Arobas , T0AD , ytc , Kwai_lo , Killer_3K , TaMaMBoLo , gizmo , Gota , ExtaBrain , Alpine , WarezPup , zoltan , [yAtes] , TarGon , Icecream , Punkguy2 , Sortof , TRDdonjuan , Lord Soth , Judged , G-Rom , Quantico , Christal , psike , Leo0n , Albator , +Spath , +Frog's Print , toutim , Pulsar , Night , psike , Uno , F|SH , Lixus , LosT , RD-116 , Ben0 , Whizkid , [MandKind] , alpine , Alsindor , Stone , Elraizer , Fravia+ , Iczelion , nody , Asphalt , Rhythm , rudeboy , X-Calibre , Cirus , shaoni... ... "Put your name here! :P" ... last words: i hope i will finish to keygen that goddamn CORE official Crackme i am working on! hehehe ;) last words2: hehe , CORE crackme Keygened ;) i worked on it all the night and this morning as well.. And guess what ?! i got it eheh Took me Ages to keygen it , but i own it now ;) Keygen Works on all Puters i tested it on! (4 PC!) Ph34r! and enjoy The day ;) Take Care, ACiD BuRN [Immortal Descendants / ECLiPSE ] òòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòò òò ____ __ __ òòáë òò / _/_ _ __ _ ___ ____/ /____ _/ / òò ëáë òò _/ // ' \/ ' \/ _ \/ __/ __/ _ `/ / òò ë ë òò /___/_/_/_/_/_/_/\___/_/ \__/\_,_/_/ òò ë ë òò ____ __ __ òò ë ë òò / __ \___ ___ _______ ___ ___/ /__ ____ / /____òò ë ë òò / /_/ / -_|_- 9 - 1 = 8) In our target, for ACiD BuRN , we type this : bpr 15DB338 015DB338+8 RW Now , you can disable our bpx on getwindowtextA! ( bd 0 ) You just have to press F5 and we will land in directly in the algo :) well , on this app , not directly , we land in the dll so keep pressing F5 till you are in DLLs :) 'Coz, we don't give a flying fuck of them :p Once you are in the App, we are in the good place! and algo starts there : look my winice.log ----------------------SNiP----- SNiP----- SNiP---------------------------- :bpx getwindowtexta Break due to BPX USER32!GetWindowTextA (ET=1.17 seconds) :dd esp :d 15f5a18 Break due to G (ET=268.99 microseconds) :bpr 15f5a18 15f5a18+8 RW :bd 0 Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW Break due to BPR #0267:015F5A18 #0267:015F5A20 RW :u eip l 50 comment: here comes the first loop: 025F:0040A173 8B442420 MOV EAX,[ESP+20] ; EAX contains the adress of my name 025F:0040A177 0FBE0C06 MOVSX ECX,BYTE PTR [EAX+ESI] ; ECX = hex value of 1st char 025F:0040A17B 51 PUSH ECX 025F:0040A17C E8E9BB0100 CALL 00425D6A ; intresting! 025F:0040A181 83C404 ADD ESP,04 025F:0040A184 03E8 ADD EBP,EAX ; add ascii value in hex to EBP 025F:0040A186 46 INC ESI ; next char! 025F:0040A187 3BF7 CMP ESI,EDI ; All chars done ?! 025F:0040A189 7CE8 JL 0040A173 ; no, jmp start! 025F:0040A18B 8B4C240C MOV ECX,[ESP+0C] / 025F:0040A18F BAC0D40100 MOV EDX,0001D4C0 / 025F:0040A194 2BD5 SUB EDX,EBP / we will look that 025F:0040A196 33C0 XOR EAX,EAX / after! 025F:0040A198 3BCA CMP ECX,EDX / 025F:0040A19A 8D4C2420 LEA ECX,[ESP+20] / 025F:0040A19E 0F94C0 SETZ AL / So, we see that it takes ascii value of each chars and add them in EBP. But there is a Call which looks intresting! let's have a closer look in it : :u eip l 50 025F:00425D6A 53 PUSH EBX 025F:00425D6B 33DB XOR EBX,EBX ; EBX=0 025F:00425D6D 391D74344800 CMP [00483474],EBX 025F:00425D73 7513 JNZ 00425D88 025F:00425D75 8B442408 MOV EAX,[ESP+08] ;move ascii value in EAX 025F:00425D79 83F861 CMP EAX,61 ;compare it to 61h 025F:00425D7C 7C59 JL 00425DD7 ;less than 61? jump to 425DD7 025F:00425D7E 83F87A CMP EAX,7A ;compare it to 7A 025F:00425D81 7F54 JG 00425DD7 ;greater than 7A? jump to 425DD7 025F:00425D83 83E820 SUB EAX,20 ;less than 7A but greater than 61 (eax-20) 025F:00425D86 5B POP EBX 025F:00425D87 C3 RET ;ret! come out of the call! 025F:00425D88 56 PUSH ESI 025F:00425D89 BE88484800 MOV ESI,00484888 025F:00425D8E 57 PUSH EDI 025F:00425D8F 56 PUSH ESI Ok , so what's goin' on ?! Well it compares the char to 61 , 7A! 61h = a and 7Ah = z if it is less than 7A but greater than 61 it substract 20 to it Well , this is just making all the chars in uppercase! So the serial for ACiD BuRN will be the same than for Acid Burn , acid burn, ACID burn... So what does the main loop ? Convert in uppercase and then add ascii value to EBP... Do all Chars and then we land here: 025F:0040A18B 8B4C240C MOV ECX,[ESP+0C] ; ECX = our fake entered serial 025F:0040A18F BAC0D40100 MOV EDX,0001D4C0 ; EDX = 1D4C0h = 12000 025F:0040A194 2BD5 SUB EDX,EBP ; EDX = EDX - EBP 025F:0040A196 33C0 XOR EAX,EAX ; EAX = 0 025F:0040A198 3BCA CMP ECX,EDX ; Compare fake serial to good one 025F:0040A19A 8D4C2420 LEA ECX,[ESP+20] 025F:0040A19E 0F94C0 SETZ AL it is clear enough! So the algo is: - convert all chars to uppercase - add all ascii value - Substract the result of ascii added to 12000 Now ,you can easily code a keygen for MP3 Explorer! As usual , i am gonna give you the source of a working Keygen coded by me :) No more Visual basic ( i was lazy hehehe!) here it is C++ + inline asm :) -------------------------start of my source--------------------------------- #include #include #include int main(){ int i,len; unsigned char name[100]; unsigned long check=128; printf("\Mp3 Explorer Keygen By : ACiD BuRN [Immortal descendants] \n "); printf("\__________________________________________________________"); printf("\nEnter name: "); gets(name); len=strlen(name); asm { xor ecx, ecx xor edi, edi mov edx, [len] start1: movsx eax, [name+ecx] cmp eax, 97 jl temp1 cmp eax, 122 jg temp1 sub eax, 32 temp1: add edi, eax inc ecx cmp ecx, edx jne start1 mov eax, 120000 sub eax, edi mov [check], eax } printf("=: %lu" ,check); /* %lu = decimal, check = serial */ printf("\nEnjoy!"); getch(); return 0; } ----------------------------end of my source--------------------------------- Info: if you compil this keygen it will works but if you enter a name with accents ie: fr‚d‚ric or C‚dric ... the given serial won't work.. Why that ? i dunno ... looks like the compiler fuck up a bit the code hehe Because if you compil this algo in a 32 bits GUI Keygen it will works for evername! But hell! i ain't gonna give you my C++ template :p hehe :) This tutorial is over and i hope you learnt something from it... btw , as i don't have internet anymore, don't mail me your question coz i don't know when i would read them! But Go on #Cracking4newbies and go nag an OP there ;-Ý This tutorial is dedicated to my girly! Celine , you own me!:) Greets fly out to: no specific order CyberBlade,R!SC , ^INFeRNo^ , AB4DS , Klefz , Volatility , TORN@DO , T4D , Jeff , [Virus] , JaNe , Appbusta , Duelist , tKC , BuLLeT , Lucifer48 , MiZ , DnNuke , Bjanes , Skymarshall , afkayas , elmopio , SiFLyiNG , Fire Worx , CrackZ , neural_en , WarezPup , _y , SiONIDE , SKORPIEN , Lazarus , Eternal_Bliss , Magic Raphoun , DEZM , Bisoux , Carpathia , K17 , theMc , noos , Xmen , TeeJi , JB007 , Arobas , T0AD , ytc , Kwai_lo , Killer_3K , TaMaMBoLo , gizmo , Gota , ExtaBrain , Alpine , WarezPup , zoltan , [yAtes] , TarGon , Icecream , Punkguy2 , Sortof , TRDdonjuan , Lord Soth , Judged , G-Rom , Quantico , Christal , psike , Leo0n , Albator , +Spath , +Frog's Print , toutim , Pulsar , Night , psike , Uno , F|SH , Lixus , LosT , RD-116 , Ben0 , Whizkid , [MandKind] , alpine , Alsindor , Stone , Elraizer , Fravia+ , Iczelion , nody , Asphalt , Rhythm , rudeboy , X-Calibre , Cirus , shaoni... ... "Put your name here! :P" ... Take Care, ACiD BuRN [Immortal Descendants / ECLiPSE ] òòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòòò òò ____ __ __ òòáë òò / _/_ _ __ _ ___ ____/ /____ _/ / òò ëáë òò _/ // ' \/ ' \/ _ \/ __/ __/ _ `/ / òò ë ë òò /___/_/_/_/_/_/_/\___/_/ \__/\_,_/_/ òò ë ë òò ____ __ __ òò ë ë òò / __ \___ ___ _______ ___ ___/ /__ ____ / /____òò ë ë òò / /_/ / -_|_-