Hellforge Crackme 1 Solution Tutorial

Introduction:

Well in order to fully understand this tutorial and use it to it's full potential it is required that you already have a firm knowledge and good understanding of how to use W32Dasm as well as a basic sense for cracking. Firstly this crack would usually simply be done using SoftIce yet in this tutorial I will show you, and hopefully teach you how to obtain the correct serial number using W32Dasm. Before attempting to crack this crackme it would be a good idea to read this tutorial through at least once and to print out a copy to hold in your hand as you travel through the cracking process. Good luck!

The Essay:

Start simply by running the crackme once to get the feel of the protection. Enter a dummy code (eg. 777777) and click the button, the message you will receive is 'Wrong code', remember this message, write it down somewhere if need be. Writing things down is a good habit to get into. Now disassemble the crackme exe with W32Dasm. Once W32Dasm has completed the disassembly click on 'Refs' then on 'String Data References'. Scroll down until you find the string 'Wrong code' (Hint, it's the 2nd last one), then double click on it. Close the String Data References window and lets begin analyzing the code.

:0042689b 8B45FC

mov eax, dword ptr [ebp-04]

* Possible StringData Ref from Code Obj ->"Wrong code"

- You land Here

:0042689E BA0C694200

mov edx, 0042690C

:004268A3 E8CCCBFDFF

call 00403474

:004268A8 7518

jne 004268C2

:004268AA 6A00

push 00000000

From the code above we can see that a value is moved to EAX and the string 'Wrong code' is moved to EDX. Anyhow that looks a bit interesting, lets have a look inside the CALL that follows. Press the down arrow until the line with 'CALL 00403474' is highlighted, now click on 'Execute Text', then 'Execute Call'. You are now inside the code from the CALL. Let's try and see what's going on here.

:00403474 53

push ebx

:00403475 56

push esi

 :00403476 57

push edi

:00403477 89C6

mov esi, eax

:00403479 89D7

mov edi, edx

:0040347B 39D0

cmp eax, edx

:0040347D 0F848F000000

je 00403512

:00403483 85F6

test esi, esi

:00403485 7468

je 004034EF

:00403487 85FF

test edi, edi

:00403489 746B

je 004034F6

:0040348B 8B46FC

mov eax, dword ptr [esi-04]

:0040348E 8B57FC

mov edx, dword ptr [edi-04]

:00403491 29D0

sub eax, edx

:00403493 7702

ja 00403497

:00403495 01C2

add edx, eax

That's very strange, the string 'Wrong code' is compared against the value held in EAX. Well let's leave this call, click on 'Execute Text', then 'Return from Call'. The purpose of that call was to compare EAX and EDX, if they are not equal the program will jump to 4268C2. Let's see what that is, click 'Goto', then 'Goto code location', type 4268C2 and press enter. Hmmm, look where we are.

:004268C2 6A00

push 00000000

:004268C4 B94C694200

mov ecx, 42694C

* Possible StringData Ref from Code Obj ->"Wrong code"

We are at the error message that you receive when you type in an incorrect serial number. This is pretty strange. Remember that the jump after CALL 00403474 was if the values of EAX and EDX didn't match, well what if they did, then there wouldn't be a jump and the program would continue with the code. Go back to that jump. Now wait a minute, look at the string that is displayed if EAX and EDX happen to be equal.

* Possible StringData Ref from Code Obj ->";-)"

Hmmm, a smiley face. Even more strange.

* Possible StringData Ref from Code Obj ->"Sometimes, the wrong code can be the good code"

This looks a lot like the 'Congratulations, you've cracked me message'. In order to get here though we need to make EAX equal to EDX which held the string 'Wrong code'. Hang on a sec, do you think that just maybe the correct code could be 'Wrong code'. Well, only one way to find out, quick run the program and enter 'Wrong code' as the code. What message do you get? "Sometimes, the wrong code is the good code" Well it was supposed to be tricky, now I understand why. Good job LaZaRuS!

Conclusion:

I hope that my blabbering on has taught you something that will help you or at least shown you how to crack this protection without the use of SoftIce. Any questions please forward to sigmental@yahoo.com