Posted by EvilTeach on 1/24/2000, 4:28 pm
, in reply to "Task IIIa"
64.20.9.74
Task III
c) How does the keygen work:I began homing in on the keygen by putting a BPX on the Wrong Serial MessageBoxExA. Then, I scrolled up in the listing until I found a couple of CMPs followed by jumps. There I assigned a BPX to watch what happened. This is where I first saw the complete serial #. Putting a BPM (or BPR) on the memory location and trying again I found a spot where the numeric part of the serial was stored.....BPM on that.....see where the code wrote to that...and so on....I found that the program moved things around quite a bit in memory...lots of little changes made. Finally I got to the actual keygen routine at 47f77c (it does some setup and then begins the actual calculations at 47f7b1).
Looking at this code in the deadlisting we can see that it takes each letter of the name and multiplies it by a value in a lookup table. Then it adds this value to ESI (which began at 0). It repeats this for each letter of the name. Then it does the same for each letter of the company name, using another lookup table.
A couple of notes about the lookup table:
Each value is a signed 8-bit number which is copied to a 32-bit number (and sign extended. Thus, we are adding or subtracting signed numbers.
If the name (or company) has more than 15 letters, the program begins back at the beginning of the correct look up table.
When done with the calculation the resulting number is divided by 100000 and only the remainder is used for the serial number (modulus division), thus providing a 5 digit number.Since I did task IIIa in VC++, I decided to do the keygen in VB. Here's the source code that I used:
txtName, txtCompany, and txtSerial are 3 textboxes on the form...
Option Explicit
Option Base 1
Dim inName As Variant
Dim inCompany As Variant
Dim serialNumber As LongPrivate Sub cmdGenerate_Click()
Dim placeHolder As Integer
Dim inCharacter As Integer
Dim i As Integer
serialNumber = 0
For i = 1 To Len(txtName)
placeHolder = placeHolder + 1
If placeHolder > 16 Then
placeHolder = 1
End If
inCharacter = Asc(Mid$(txtName, i, 1))
serialNumber = serialNumber + (inCharacter * inName(placeHolder))
Next
placeHolder = 0
For i = 1 To Len(txtCompany)
placeHolder = placeHolder + 1
If placeHolder > 16 Then
placeHolder = 1
End If
inCharacter = Asc(Mid$(txtCompany, i, 1))
serialNumber = serialNumber + (inCharacter * inCompany(placeHolder))
Next
serialNumber = serialNumber Mod 100000
txtSerial = "AC200-" & serialNumber
End SubPrivate Sub Form_Load()
inName = Array(-21, 12, -67, 124, 125, 61, -59, -55, 1, 124, -6, -44, 104, -94, 125, 42)
inCompany = Array(20, 43, 63, 87, -100, -16, 124, 13, 14, -1, 2, 54, 74, 25, 14, -22)
End SubI'd be happy to answer any further questions any of you might have.
Regards,
EvilTeach