160 crackme training for novice crackers

The purpose of this series of articles is to try to crack all 160 CrackMe step by step from the perspective of a novice with no experience. If possible, write something similar to a registered machine by any means.
Among them, the article is arranged according to the following logic (to solve the following problems):
1. What environment and tools to use
2. Program analysis
3. Thinking analysis and cracking process
4. Exploring the registration machine

1. Tools and environment:

WinXP SP3 + OD + PEID + compilation cheat.

Note:
1). The Win7 system enables the function of random initial addresses for modules and programs, which will bring a great burden to the analysis, so it is not recommended to use Win7 for analysis.
2). The above tools are all original programs, NOD32 does not report viruses, and I promise that I will never carry out any content related to Trojan horse viruses.

2. Program analysis:
To crack a program, you must first understand the program. Therefore, in the cracking process, the analysis of the original program is very important. It can help us understand the author’s purpose and intention, especially the processing details of the registration code, so as to facilitate our backward tracking and derivation.
Open the CHM file, save the first file Acid burn.exe, create a folder of 01, put the exe here, and store the future analysis files here. Open Acid burn.exe, enter and click at will, familiar with the program flow.

We found that this software is divided into two parts, one is Serial/Name, you need to enter the user name and registration code to pass, and the other Serial only needs to enter a registration code and other things. We randomly choose a start, for example, the first one.

We randomly enter a username and serial number (pseudo code):
Pseudo code:
Name:112233
Serial:44556677
Click Check it Baby! It will pop up a dialog box prompt: Sorry, The Serial is incorrect!
Change a few more and try at will, and found that this is the case.
OK, the dialog box appears, which is easy to handle. It means that after checking the registration code, the author will pop up the window if it is wrong. We only need to find the place where the dialog box pops up and follow up to find out whether the judgment is correct. Yes, jmp or Nop is blasted.

3. The specific steps are as follows:
We randomly enter a username and serial number (pseudo code):
Name:112233
Serial:44556677
Click Check it Baby! It will pop up a dialog box prompt: Sorry, The Serial is incorrect!
Do not click the OK button at this time, return to OD pause (F12), click the stack-K small icon (Ctrl+K), as shown in the following figure:

There are two MessageBox addresses. The first address is 77D5082F. This address is obviously too large, not in the airspace of the module, it is not. The second address is 0042A1AE, which is very close to the address 00400100, and it will probably be it.
Right click show call and set a breakpoint on Call.
View nearby code:

It is found that there is no jump statement, and the logic is very simple. There is retn in the upper few lines, break under push ebp at the head, and click the Check it baby button again to find the most recent Return statement on the stack in the lower right corner:
0012F974 0042FB37 RETURN to Acid_bur.0042FB37 from Acid_bur.0042A170
Right click Follow in Disassm.. (disassembly follow), here is a jump directly connected, the code is as follows:

Does it feel very cordial to see the same text as the prompt box? OK, let’s go through the code. There are two suspicious jumps JNZ and JMP in the recent part. JNZ will use the call 004039FC on it to judge whether our pseudo code is correct. The judgment result is stored in EAX. If EAX is not equal to it, jump Go to the error message box. Our goal is to pass the verification regardless of whether the pseudocode is correct or not, so the easiest way is to fill the sentence jnz with NOP. Let’s try it: select the sentence JNZ, right-click Binary->Fill with NOPS. Go back to the original program, and again Click Check it baby!
Haha, remind Good Job! Passed!
Comparing MessageBox and the last call of the stack (Ctrl+K) window again, is there anything special? right! That CALL is where the MessageBox is called, so next time we don’t need to break the trace at the MessageBox, just go to the last address, show call.

4. Registration machine part
The above part is blasting analysis, let’s see if we can analyze the algorithm of the registration machine.
Break CALL on the line above the original JNZ: Click the Ckeck it Baby! button, the program breaks:

We found that EDX stores our fake serial number, EAX looks like a correct serial number, or it may be the corresponding user name, we can try it.
Now restore the code we modified before: select those two lines of NOP, right click Undo… Cancel the breakpoint. First try to see if it is Name, enter the value of EAX for Name, continue to 44556677 on the next line, and continue to play wrong. Then try as the serial number, Name is 112233, Serial is CW-4018-CRACKED, try again, OK! Completely correct!

Summary: Before this CALL, the program has already calculated the serial number corresponding to the user name, and then compared with the Serial we entered through this CALL, and finally gave a prompt message. The algorithm we want is not in this CALL.
The next step is to continue to break the CALL above this CALL, and analyze the CALL that produced this serial number. Since the return value of CALL is generally stored in EAX, we can check the value of EAX after nearby CALL to determine the correct registration code generation function.

Two CALLs nearby:

Break off the sentence after CALL, click the button, step F8, and find that the correct registration code appears in CALL 1 nearby, indicating that it may be the key registration code CALL. The following is an analysis of it:
Disconnect again at call 0041AA58,

There is no special information about edx and eax, we can be more sure that the registration code is generated in the call.
At this time, we have two solutions, one is to analyze the parameters of CALL and call CALL remotely to generate the correct registration code, and the other is to analyze the content of CALL and write a generation process based on his algorithm. There is no obvious difference between these two, it just depends on where they are used.
According to my understanding, the first type, memory call is suitable for programs with complex algorithms or infrequent updates. This can save time and complexity. The second is that the algorithm is not particularly complicated, or the software is updated frequently, the complexity of the algorithm is not to say, no matter how frequently the software is updated, the general registration code algorithm will not change, so the generated registration machine can be applied All versions save trouble for everyone.
Well, having said so much, start a formal analysis:
(Since CALL has been called many times here, the parameters of each register are messy, it is recommended to load the program again for easy analysis)
Enter CALL 0041AA58, the code is as follows:
(Because this CALL has been called in many places, we must single-step F7 tracking from the upper CALL each time until we find the correct CALL)

We found that there is no place to generate the registration code, and all CALLs are constantly being called. Therefore, it is preliminarily determined that the registration code is not generated here. But thinking like this completely overturned the previous speculation, indicating that there is a problem with our thinking, that is, there is a problem with our thinking. Since his registration code was not calculated instantly, it must have been calculated in advance. Let us go back to the CALL where the registration code was generated, look up, and press F8 to view it in a single step.

Summary: Take the ASNI number of the first letter. For example, the first character 1 in 112233 corresponds to the number 0x31, and then multiply it by 0x29, and the result is doubled (ie x2), and the resulting number is converted to 10 The registered character string, add “CW-” in front and “-CRACKED” at the end to form the registration code corresponding to the user name.
C/CPP program:

The second single Serial
The process is the same as the first one,

But this is very simple, you can basically understand it by pressing F8 upwards directly in the call to CALL.
Core code:
The JNZ before CALL is the key to blasting, and NOP is OK.
The CALL before JNZ is the key to the serial judgment, and it is found that it is a fixed value through single-step tracking.
code show as below:

This registration code, which is not dynamically generated, is a fixed one: Hello Dude!