kernelkennel - crackmes

CrackMe2 by Pride

2025-07-08T15:00:00+00:00

CrackMe2 by Pride
#</a> </h3> If we now step-in</code> a few lines and jump into the CALL on 0x401458</code>, and move a bit down the call after inputting our serial, we see that the address 0x43C33A</code> is using strlen() and storing this into a DWORD offset from the EBP, interesting... we are getting the length of an inputted string from our name</code> for future use.</p> On 0x40147B</code>, we jump into the CALL for putting in the serial. Let's set a breakpoint on the address after this call to step line by line what we are doing!</em> This is at 0x401480</code> of course. Another call up ahead, and we will set another breakpoint after it at 0x40148B</code> with ADD EAX, 0CA</code>.</p> Interesting! When breaking at this address before it runs through the addition, where ADD will do the following in pseudocode:</p> ADD <into this>, <this value></code></p> We can see that EAX has been populated with the value of strlen()! For me, this was B (decimal 11), and we're adding 0xCA which should go to 0xD5 given 0xB.</p> The next line is more arithmetic, so let's step-into/continue execution.</p> The next line is XOR EAX, 3D8D40F</code>, meaning we now need to perform eXclusive OR against register EAX and 0x3D8D40F. eXclusive OR (XOR) is like a not-equality operation</em>, in that the truth table is going to be as such:</p> A | B | A XOR B 1 | 0 | 1 1 | 1 | 0 0 | 1 | 1 0 | 0 | 0</p> Since one value (at EAX) is likely going to be way smaller than 0x3D8D40F (64541711), we're going to get something close to this value as all leading bits ahead of our much smaller number will be 0.</p> Given 0xD5</code>, we'll get 0x3D8D4DA</code> (64541914). The next lines are interesting in that it is clear we'll likely be comparing this:</p> MOV DWORD PTR SS:[EBP-38], EAX ;storing our result MOV EAX, DWORD PTR SS:[EBP-30] ;getting a value further down the stack to EAX CMP EAX, DWORD PTR SS:[EBP-38] ;we are comparing the two values!!!!!!! JNZ SHORT CrackMe#.004014C6 ; the the apsr flags say its not zero(equal), lets jump ; if not, we can continue to "Gratz"! </code></pre> Awesome! So the first serial check is solved. In short:</p> - Enter name, any str - CrackMe checks strlen(name) and stores somewhere - We get strlen(name) + 0xCA - This sum is XOR 0x3D8D40F - Chcked for equality with stored value in EBP-30, which is a constant value. </code></pre> Now we can get back and do the next keygen! Given this, we can get by with knowing the values for further debugging.</p> Master Serial#</a> </h2> This one is a lot easier and we can use the same debugging techniques here. Make sure to set a breakpoint on any execution after the address that gets stuck running awaiting input!</p> We get stuck on 0x40152A</code> calls to input the master serial now, and what is interesting without even going in is that we have a very similar set of instructions after we RET from this input call:</p> MOV EAX, DWORD PTR SS:[EBP-2C] ; we are getting a value from -2C ADD EAX, DWORD PTR SS:[EBP-38] ; hey... we've seen this guy before.... ADD EAX, 0D75E9 ; add a value to our beautiful EAX MOV DWORD PTR SS:[EBP-3C], EAX MOV EAX, DWORD PTR SS:[EBP-34] CMP EAX DWORD PTR SS:[EBP-3C] JNZ CrackMe#.00401569 ... ; see you space cowboy... </code></pre> Hopefully it's a little clearer now what we may be doing with some static analysis and with a warmup from our dynamic searching of the first serial.</p> We are putting back in our first serial that is correct and adding it to EAX which as a value from EBP-2C</code>. We then ADD 0x0D75E9</code> and put it away into EBP-3C</code> for safekeeping before checking it. When running the program, we can see that EBP-2C at 0x40152F</code> is a static value of 0x183A0</code> So this means in short:</p> - MOV 0x183A0 to EAX - ADD the previous serial to EAX - ADD 0xD75E9 to EAX - Put it away for safekeeping - Pull in EBP-34 which is our 'true' master serial - Check and jump if not equal! </code></pre> Easy enough! This one is a lot more easier since this is just addition and some moving around values in the stack.</p> Simply get the previous correct serial, add 0x183A0</code> (99232) and 0xD75E9</code> (882153) and we're in business!</p> Keygen#</a> </h3> Lovely simple keygen for this one, but great fun doing a little easy practice on x86 ASM. Let's put all we know into use now in a tidy script:</p> def main(): name = input() nameLen = int(len(name)) serial1 = nameLen + 0xCA serial1 = serial! ^ 0x3D8D40F print("First Serial: " + serial1) serial2 = serial1 + 0x186A0 + 0xD75E9 print("Second Serial" + serial2) if name == "main": main() </code></pre> This was a great little crackme, if a bit simple!</p>