Cracking 2/Cracking II..iso/Texty/crackme/CRACK3212.ASM

Assembly Source File | 1999-01-28 | 3.2 KB | 240 lines

;
;    16-bit keyfile finder. Use a bit faster 32-bit version instead it.
;
    .model tiny
    .486
    .code
    .startup
    org 100h

    mov ax,3
    int 10h

    push 0B800h
    pop gs
    call InitMagic32

    jmp @0


Key    db 13,10,"---=== Keyfile generated by Ak Kort [SOS group] ===---"
    db 13,10," http://www.sos.nanko.ru   e-mail: [e-mail] "
    db 13,10,13,10
    db 13,10,13,10
    db 256-($-offset Key) dup(1)

Magicon        equ 0edb88320h
Magic32        dword 256 dup(1)
_crc32        dd 0
msg1        byte '   Precalculating 65536 masks...',13,10,36
msg2        byte '   Cracking...',13,10,36

@0:
    lea dx,msg1
    mov ah,9
    int 21h

    xor ecx,ecx
    mov ax,cs
    add ax,4096
    mov es,ax
    mov di,0

;
;    Precalculating table
;

    @st equ 12345678h
@f10:
    push ecx
    lea si,Key
    mov eax,ecx
    shl eax,16
    mov ebx,@st
    mov bp,0
    mov cx,0FDh-8
@f11:
    push cx
        movsx cx,byte ptr [si]
        mov ax,[si+1]
        inc si
        mul cx
        mov cl,[si+2]
        @@1:
        rol eax,cl
        xor ebx,eax
        push cx
        movzx cx,al
        rol ebx,cl
        add bp,cx
        pop cx
        not eax
        loop @@1
    pop cx
    loop @f11
    mov _eax,eax

    mov cx,bp
    and cx,31
    ror ebx,cl
    xor ebx,@st
    mov es:[di],cl
    mov es:[di+1],ebx
    add di,5
    mov ax,di
    mov cx,es
    shr ax,4
    add ax,cx
    mov es,ax
    and di,15
    pop ecx
    inc cl
    jnz @f10
    inc ch
    mov gs:[0],ch
    jnz @f10
    push cs
    pop es

    lea dx,msg2
    mov ah,9
    int 21h

;
;    Precalculating crc32
;

    xor eax,eax
    xor edx,edx
    lea si,Key

    mov cx, 256-8
@f3:    mov al,[si]
    inc si
    xor al,dl
    shr edx,8
    xor edx,Magic32[eax*4]
    loop @f3

    mov Crc32,edx


;
;    main loop
;

    mov ecx,0

@e2:    push ecx

Crc32    equ dword ptr $+2
    mov edx,12345678h
    xor eax,eax
    lea si,Key+256-8

REPT 8
    mov al,cl
        shr ecx,4
    and al,15
        mov bl,dl
    inc ax
        shr edx,8
    mov [si],al
        xor al,bl
    inc si
        xor edx,Magic32[eax*4]
ENDM

    mov eax,edx
        mov ebx,edx

    shr eax,16
        mov _crc32,edx

    lea eax,[eax*4+eax+10000h]
        mov cx,cs
    mov di,ax
        shr eax,4
    and di,15
        add ax,cx
    mov ds,ax

    mov cl,ds:[di]
        push cs
    xor ebx,ds:[di+1]
        lea si, Key+0FDh-8
    rol ebx,cl
        pop ds

_eax equ dword ptr $+2
    mov eax,5555FDFDh

    xor cx,cx
    REPT 8
        local @@1
        mov   cl,byte ptr [si]
        mov     ax,[si+1]
        mul cx
        inc    si
        mov cl,[si+2]
        @@1:
        rol    eax, cl
        xor    ebx, eax
        xchg cx,ax
        rol    ebx, cl
        xchg cx,ax
        not    eax
        loop @@1
    ENDM

    cmp    ebx, 0A69EC24Eh
    jz    @ok

    pop ecx
    inc cx
    jnz @e2
    mov eax,ecx
    shr eax,16
    mov byte ptr gs:[160],ah
    mov byte ptr gs:[162],al
    add ecx,10000h
    jnz @e2

    retn

@ok:
    pop ecx
    lea dx,fname
    mov ax,3C00h
    xor cx,cx
    int 21h
    xchg ax,bx
    lea dx,Key
    mov cx,256
    mov ah,40h
    int 21h
    mov ah,3Eh
    int 21h
    retn

fname    db '!ok!',0

InitMagic32:
                std
                mov     di,OFFSET Magic32+0400h-4    ; Last WORD of the array
                mov     dx,0FFh
im0:            mov     cx,8
                movzx    eax,dx
im1:            shr     eax,1
                jnc     im2
                xor     eax,Magicon
im2:            loop    im1
                stosd
                dec     dx
                jns     im0
                cld
                ret

end