Jan. 17, 1999
"Magenta's Crackme2"
( 'Visual Basic V5 Cracking'  )
Win '95 PROGRAM
Win Code Reversing
 
 
by Jeff
 
 
Code Reversing For Beginners 
 
 
 
Program Details
Program Name: Magentas Crackme#2
Program Type: VB5 Practice Crackme
Program Location:    Eternal Bliss Crackme Practices for newbys 
Program Size:unzipped; aprox. 15 kb
 
     
Tools Used:
 Softice V3.2 - Win'95 Debugger
 
Rating
Easy ( X  )  Medium (   )  Hard (    )  Pro (    ) 
There is a crack, a crack in everything. That's how the light gets in.
 
    
 
Magenta's Crackme #2
( 'Visual Basic V5 Cracking'  )
Written by Jeff
 
 
 
Introduction
 
The author of Magenta's Crackme #2 is:-
 
Magenta...? (*grin*)
 
Magenta says in his text file:

Hi, out there. This is my next crackme in VB5. It should be a bit
harder to find out the good serial. In fact, i haven't cracked it yet.

The serial generator is a bit more difficult than the one in crackme#1.

RuleZ: Patching is not allowed!!!
 

Greetz to anybody out there

Bye Magenta
 
Finding A Serial Code; without SEARCHING any code..
 
 
I will attempt to show here how we can find a valid serial number without having to search thru any code whatsoever...
I have found several ways of doing this...and it also works on several  VB5 programs other than this one that I have tried it on...NOT many of  them ,  however!
 
 
 
The Essay 

First approach:
 
Well; as Vladimir (the newby one) would say... lets get on it before the suds dissappear:

Okay lets first open up the program...

Magenta has designed a nice liitle input box with a place for your name and a serial...

Lets go ahead and fill these areas in:

I would suggest that the first time you run thru this exercise... to use my input so you can SEE the following example work out in its entirity in the data window:

I will use  " The GypsyJoker "
... for the name value:
and
7777767
for the serial value

Now lets open ice:

use your ctrl-d key combo (press the ctrl and d key  together at same time) and ice pops:

now just type in:

bpx __vbastrcomp  (NOTE: you use TWO underscores here; __ )

now type:

x  (to leave ice) (then use your enter key to execute)
 

you will leave softice and get back to windows:

now simply click on the OKAY button

Softice will now pop; and you will be here:
 
We have landed inside the __vbastrcomp Msvbvm50! code area:

NOTE: I have found that this works cleanly on a fresh boot; if you have been working on other programs during the day and have lots of bpx's set in memory for some reason ice will POP the Error box ;
instead of popping directly back to __vbastrcomp area... (?)
in this case...no problem...click on the error box and now re-fill in your user info...now click on OKay and ice will now pop back to __vbastrcomp area of code)
 

Now we are going to move away from the natural impulse to begin f-10-ing and searching each register as we move along...

As I stated in my first VB5 essay; in the solution #5;  I have found  that by using a certain sequence of set-up  we can produce a working serial # without searching any code at all...this is what I will demonstrate here:

Now do not use your f-10 key at all....

      Look, now,  to your 'data window'

 Put your your mouse cursor on the line that splits the data window and click on the word 'byte'
       
(which is probably the window that most systems will pop first)

Your data window will now change and the data line will now say:

..........................................................................---------word------

 Now click on the word............................................-----"word"-------

 The data window will now change to this word...

      ...................................................................---------dword-------

      It is in this data window that we want to be in;

      Having arrived at this window now we will type:

      dd esp

      This will once again change our data window;

      You will now see a lot of numbers in colums:

      the first line will look like this:

            0157:0063f194...0f00461b......00000000......00401d24......00412208
 

(NOTE: YOUR numbers in the third and fourth stack just might be a different #; it does not matter; simply use the # you see instead of the one I write in my example)
 
(I think that the number in the first colum at 0f00461b...is the line number assigned FROM WHERE THIS memory location was called from...

 ...but I am not sure... when I tpye "d 0f00461b" and hit the 'f-11 ' key it takes me to that line in the
  code...but I don't know where to take it from there to continue backtracing; as yet)
 

Now with no further-a-do...

type: 'd  00412208 '...(or whatever # you see in the forth colum)

This should now display the USERNAME you entered... you'll see it in your data window.

For some reason beyond me if we are not in this mode and in this sequence then we will not SEE our serial being calculated:

In this mode we should now be able to see and watch your serial # being calculated and being generated while in  this data window.

Now; hit your f-5 key... 3 times...
(this is ONLY if you are using my username as your test subject here: if you use a different Username the number of times you hit f-5 and see changes in the data window will be different)

after pressing the f-5 key 3 times you will see in your data window:

the number "20"

continue pressing the f-5 key;  watching this data window;

at; the  6th  f-5 key pressed  you will now see:

the number "2039"

at 7th f-5= "203950"
at 9th f-5="2039503"
10th  f-5="20395036"
12th  f-5="2039503637"
15th  f-5="203950363713"
16th  f-5= The looser---"Better luck next time!"--- error box....pops

Now just click the Okay button on the error box; enter the #  203950363713 into the serial area...and click Okay button...

WHOOPS ice pops; we did not clear out out __vbastrcomp breakpoint;
type bd 00 x ;  (then enter key)

and Windows pops back with the:

Congratulations box ;... Job Well Done, Good Work!

CONGRATULATIONS!

This VB5 is Busted!

 


 
Final Notes 
    
This procedure will not work on very many of the VB5 programs that I have tested; it did work on several however. And so when we find a program that is generated in this particular way then I believe that this procedure will work out fine.
I had planned to include two more ways to bust this program; including the line number in which displays the actual reg code but I have decided not to dilute this method; and I leave the further exploring of this crackme to you.

As we have continued to learn at the Sandmans projects site @  http://disc.server.com/Indices/33330.html the crack is not done until the cracker ' knows' his crack.
 

My thanks and gratitude goes to:-
 
The Sandman for providing possibly the greatest source of Reverse Engineering
knowledge for newbys on the Web; and who told me to never give up when VB was strangeling me.

In this essay I would also like to extend special thanks to The Administrator; Pedro; Princess; Joseph; &  Flying; who helped me work out my rough draft with their many suggestions; I would also like to extend additional special thanks to Eternal Bliss who is always one step ahead of me in figuring out just what it is I keep tripping over; and,  his explanations, I am confident will soon lead us all to a new way of understanding VB and new ways to attack it...

And to all those of you who write, and post, and teach me each day, no matter your depth of knowledge; Thanks!
 

 
Ob Duh 
 
Do I really have to remind you all that by buying and NOT stealing the software you use will ensure that these software houses will be encouraged to producing even *better* software for us to use and enjoy.

Ripping off software through serials and cracks is for lamers..
 
If your looking for cracks or serial numbers from these pages then your wasting your time, try searching elsewhere on the Web under Warze, Cracks etc.
 


 More more info. and instruction for newby knowledge goto:
 
 

Essay by:          Jeff
Page Created: jan 17, 1999