Tutorial - Basic Keygenning : Hang2000 1.31Target : Hang2000 1.31 http://www.mv.com/ipusers/spacetime/ I am bringing here a very easy target (hopefully) to give a good introduction to any new crackers who cannot keygen yet and those who still have blurred visions on the subject of keygenning. This kind of (easy) essay may not be produced anymore in the future (at least not by me), so take this very good chance and learn as much as possible. Protection is a Name/Serial. Copyright information : This tutorial is copyright © ManKind. |
Allow me to start by explaining a few basics. A keygen is an automated program written by cracker to generate valid registration information for a specific shareware/commercial program (a generic keygen is sometimes possible). How does it generate valid registration information? Well, the cracker first has to have the program he wants to keygen and using some typical crackers' tools especially a debugger (SoftICE) as his weapon, he will TRY to understand how valid registration information is generated in that program (usually the program takes in a name and a serial, and to test whether the serial is valid or not, it itself has to generate a valid serial before it can compare the valid serial with the one entered by user).
If you succeed in understanding how valid registration information is generated, you can re-code the routine in any programming language that suits you. If you aren't successful, you still have the option to brutally crack (patch) the program or you might try ripping the assembly code from the dead-listing and try to re-compile in an assembler without actually understanding how the valid registration information is being generated, you could also sniff out a serial or build an internal keygen in the program itself.
Though there exist quite some ways to keygen, I still consider by understanding the valid registration information generation routine and re-code it is the most original, unique and best way. It is also worthwhile to note that in the WAREZ or cracking scene, a keygen is considered the best crack compared to patching and sniffing a serial. One last thing I want you to know is that there are actually a variety of different keygens available, some of them which are key filemakers (that's a variation of keygen!), single serial keygen and hmm, say generic keygen for several programs...
Now, let's get specific. I will show you from the beginning till the end how we can keygen this (easy) target of ours. Run Hang2000 and go to the registration screen (File -> Register). As I have told you, it will take in a name and a serial. Just in case you do not know yet, whenever we try to register a program, we have to enter some registration information even though we know that the information is not valid. The FAKE registration information is used to pass the very first check of the program (a basic check to prevent users from easily registering the program).
The check is usually done by checking the length of user's name and/or serial. Only name and/or serial with certain length will pass the check. If we do not pass the check, it is likely that we will immediately be confronted by message like "Sorry, your registration information is not valid" which I like to call the bad_boy message, and when so, the valid registration information will not be generated at all to be compared with our fake registration information and to conclude, if that happens we will not be able to understand how the valid registration information is generated.
Until we dive into the code, we will not know the check looks like, but one thing we are sure of is that we must not have empty (0 in length) name and seria l(I am sure out of my experience :D ). So, in order to not have empty name and serial, we fill in the following temporary (not fake, as we are gonna validate a registration based on the following name) registration information in the appropriate text fields (you can of course change the following information but my explanation in this essay will be based on the MY own registration information) :-
Name : ManKind
Serial# : 23199981
(NOTE : selection of 23199981 as serial is not adhered to any rules, it is just my lucky and usual fake serial from the very beginning of my cracking career :D).
Set a breakpoint on GetDlgItemTextA in SoftICE which is a very common API function to get text from text fields (another usual one is GetWindowTextA) with the following command :-
bpx GetDlgItemTextA
With this breakpoint, we will be able to break into our target's code when it tries to get our name and serial (that is after we press the Register button) and that will land us quite near to where valid registration information, in this case, the valid serial will be generated and later compared with our temporary serial (actually you don't need to break in here, you can break in from the program's entry point with Symbol Loader but that will keep you tracing with F10 (step over) for a long long time and still that does not promise you an exact place where the real serial is generated, so in fact, breaking into the program when you have entered your temporary registration information is the best and most recommended :D ).
After setting the breakpoint, come out of SoftICE and press the Register button. You will be thrown into SoftICE and you are now in the middle of the GetDlgItemTextA API function and this is not what we are interested in, so, press F11 once to return to the caller of the API function that will land inside the process of Hang2000 (disable your breakpoint on GetDlgItemTextA) :-
* Reference To: USER32.GetDlgItemTextA, Ord:0104h :00406A02 mov esi, dword ptr [00411224] <-- esi contains the GetDlgItemTextA API function :00406A08 push ebx :00406A09 mov ebx, dword ptr [esp+00000210] :00406A10 lea ecx, dword ptr [esp+0000008C] :00406A17 push 28 :00406A19 push ecx * Dialog: DialogID_008A, CONTROL_ID:03EC, "&6" <-- text field for Name :00406A1A push 3EC :00406A1F push ebx :00406A20 call esi <-- call GetDlgItemTextA API to get name :00406A22 lea edx, dword ptr [esp+0C] :00406A26 push 1E :00406A28 push edx * Dialog: DialogID_008A, CONTROL_ID:03ED, "&8" <-- text field for Serial # :00406A29 push 3ED :00406A2E push ebx :00406A2F call esi <-- text field for Serial# to get serial :00406A31 lea eax, dword ptr [esp+0C] :00406A35 lea ecx, dword ptr [esp+8C] :00406A3C push eax :00406A3D push ecx :00406A3E call 00406CD0 <-- *** :00406A43 add esp, 8 :00406A46 cmp ax, 0001 <-- compare ax with one :00406A4A jne 00406AF7 <-- jump to bad_boy if ax not equal to 1
There is not much to be said about the above code. The important code is the call at address 00406A3E which I have marked with three asterisks (*). After returning from the call, a compare will be done with the ax register to see if we have entered valid registration information. How do I know that the call marked with 3 asterisks is important and how do I know that the cmp and jne instructions at address 00406A46 and 00406A4A are the codes to verify whether we have entered valid registration information? Well, all the calls before the one marked with 3 asterisks do not look suspicious as they are only there to get our name and serial while immediately after returning from the call marked with 3 asterisks, verification is done to see if we have entered valid registration information (try to enter a fake name/serial and follow the jump to address 00406AF7 and you will see how I know that the cmp and jne instructions are the verification codes) and that makes the call very suspicious. I am very sure that the whole key generation routine (routine to generate valid registration information) is in that call, so let's trace into it by pressing F8 (trace into) in SoftICE when the white line of indicator is on address 00406A3E :-
* Referenced by a CALL at Addresses: |:00401687 , :00406A3E :00406CD0 mov ecx, dword ptr [esp+04] :00406CD4 sub esp, 80 :00406CDA lea eax, dword ptr [esp] :00406CDE push eax :00406CDF push ecx :00406CE0 call 00406BB0 <-- **** :00406CE5 add esp, 8 :00406CE8 test ax, ax :00406CEB jne 00406CF4 <-- this will always jump unless there is no name entered :00406CED add esp, 80 :00406CF3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00406CEB(C) :00406CF4 push ebx :00406CF5 push esi :00406CF6 mov esi, dword ptr [esp+90] <-- move fake/temporary serial to esi :00406CFD lea eax, dword ptr [esp+08] <-- move the valid serial to eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00406D23(C) :00406D01 mov dl, byte ptr [eax] <-- move current byte of valid serial to dl :00406D03 mov bl, byte ptr [esi] <-- move current byte of fake serial to bl :00406D05 mov cl, dl <-- move dl to cl :00406D07 cmp dl, bl <-- compare dl with bl :00406D09 jne 00406D3A <-- jump to bad_boy if not equal :00406D0B test cl, cl <-- see if cl = null :00406D0D je 00406D25 <-- if so, jump to good_boy because all the bytes have been compared :00406D0F mov dl, byte ptr [eax+01] <-- move current+1 byte of valid serial to dl :00406D12 mov bl, byte ptr [esi+01] <-- move current+1 byte of fake serial to bl :00406D15 mov cl, dl <-- move dl to cl :00406D17 cmp dl, bl <-- compare dl with bl :00406D19 jne 00406D3A <-- jump to bad_boy if not equal :00406D1B add eax, 2 <-- update position of eax as 2 bytes have been compared :00406D1E add esi, 2 <-- do the same to esi :00406D21 test cl, cl <-- see if cl = null :00406D23 jne 00406D01 <-- jump if not because maybe there are still bytes to be compared * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00406D0D(C) :00406D25 xor eax, eax <-- start of good_boy :00406D27 xor ecx, ecx :00406D29 test eax, eax :00406D2B sete cl \ :00406D2E pop esi > important instructions :00406D2F mov ax, cx / :00406D32 pop ebx :00406D33 add esp, 80 :00406D39 ret * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:00406D09(C), :00406D19(C) :00406D3A sbb eax, eax <-- start of bad_boy :00406D3C pop esi :00406D3D sbb eax, FFFFFFFF :00406D40 xor ecx, ecx :00406D42 test eax, eax \ :00406D44 sete cl > important instructions :00406D47 mov ax, cx / :00406D4A pop ebx :00406D4B add esp, 80 :00406D51 ret
See the call I marked with 4 asterisks (*) at address 00406CE0?. I suspect that the key generation routine is all inside that call because immediately after returning from the call there is no other call and the fake serial is then compared to the valid serial. Where else can the valid serial be generated other than that call? However, before stepping into that call, I will like to ask you to not to pay attention to the part where the fake and valid serial are compared first, it is just a loop through all the chars of the two serials (never mind if you can't understand the codes of the loop, you just don't have to).
Instead, look at address 00406D2B and 00406D42 which I have marked as important instructions. Why important instructions? That is because the (sete cl) and later (mov ax, cx) instructions will determine whether we are registered or not depending on the value of ax register once we return from this call (we are in a call, remember?) back to address 00406A43. By the way, take a fast look at the jne instruction at address 00406CEB, this is the first check I previously mentioned about that we must not have empty name and serial. We want to make a keygen, don't we? Yes, we do and so let's forget about sniffing the valid serial, and step into the call marked with 4 asterisks by pressing F8 :-
* Referenced by a CALL at Address: |:00406CE0 :00406BB0 mov edx, dword ptr [esp+04] <-- move name to edx :00406BB4 sub esp, 40 :00406BB7 or ecx, FFFFFFFF :00406BBA xor eax, eax :00406BBC push ebx :00406BBD push ebp :00406BBE push esi :00406BBF push edi :00406BC0 mov edi, edx :00406BC2 xor ebp, ebp :00406BC4 repnz :00406BC5 scasb :00406BC6 not ecx <-- contains length_of_name+1 :00406BC8 dec ecx <-- decrement ecx to get length_of_name :00406BC9 mov ebx, ecx <-- move ecx to ebx :00406BCB test bx, bx <-- test if name actually exists :00406BCE jg 00406BFD <-- jump if it does to good_boy
Since we do enter a name, we will always jump to address 00406BFD. Note that this is another check whether we have entered a name or not (confirming the facts that fake registration information is really important for us :D ). Continue tracing with F10 (step over) :-
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00406BCE(C) :00406BFD mov edi, edx :00406BFF or ecx, FFFFFFFF :00406C02 xor eax, eax :00406C04 lea esi, dword ptr [esp+10] :00406C08 repnz :00406C09 scasb :00406C0A not ecx :00406C0C sub edi, ecx :00406C0E mov eax, esi :00406C10 mov edx, ecx :00406C12 mov esi, edi :00406C14 mov edi, eax :00406C16 shr ecx, 02 :00406C19 repz :00406C1A movsd :00406C1B mov ecx, edx :00406C1D and ecx, 3 :00406C20 repz :00406C21 movsb :00406C22 lea ecx, dword ptr [esp+10] :00406C26 push ecx :00406C27 call 00407560 :00406C2C add esp, 4
Lots of code but the above does not do a lot, what it does is uppercase all the characters of our name. How do I know? Do "d 0075F484" command in SoftICE without the quotes just before the call instruction at address 00406C27 and immediately after stepping over the call, the characters of your name will change to uppercase in the data window (and 1 thing I want you to note here, though here is quite an inappropriate place, is that whatever you see in data window with the d command is considered string while whatever you see in the code window with the ? command is considered number). Continue tracing and pay attention now because the following is the start of the keygenneration routine :-
:00406C2F test bx, bx <-- test if name exist
:00406C32 jle 00406C5A <-- this will always not jump when we entered a name
:00406C34 lea ecx, dword ptr [esp+10] <-- move name to ecx
:00406C38 movsx edx, bx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406C58(C)
:00406C3B mov al, byte ptr [ecx] <-- move current byte of name to al
:00406C3D cmp al, 41 <-- compare it with 65 decimal ("A")
:00406C3F jl 00406C56 <-- jump to 406C56, get next byte of name without calculating anything
:00406C41 cmp al, 5A <-- compare it with 90 decimal ("Z")
:00406C43 jg 00406C56 <-- refer to comment for address 00406C3F
:00406C45 movsx esi, al <-- move al to esi
:00406C48 add ebp, esi <-- add esi to ebp
:00406C4A cmp al, 45 <-- compare it with 69 decimal ("E")
:00406C4C jne 00406C53 <-- jump if al !="69" decimal to 00406C53 to add 3 to ebp
:00406C4E add ebp, 5 <-- add ebp with 5
:00406C51 jmp 00406C56 <-- fixed jump to 00406C56
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406C4C(C)
:00406C53 add ebp, 3 <-- add ebp with 3
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406C3F(C), :00406C43(C), :00406C51(U)
:00406C56 inc ecx <-- go to next byte of name
:00406C57 dec edx <-- decrease the counter by one
:00406C58 jne 00406C3B <-- loop it as long as edx !=0 (edx=0 means name is done)
Basically the above is a loop for as many times as the length of our name (but one thing to note is that calculation will only be done to characters of name that are in the range of A-Z) to calculate a temporary value (ebp). Pay extra attention to the jumps(jmp, jne, jg, jl) and after some time, I guess you will be able to understand the loop. Anyway the following example of a loop in C++ may help to illustrate the loop better :-