Re: Princess' Tread Wednesday, 10-Mar-99 23:20:31 VbCrackme6 Serial calculation The serial is calculated from our User name and the numbers in all three boxes First the user name (the first 8 characters only) is converted to octal Thus "Pirate Copy" becomes "Pirate C" which in octal is 120, 151,162, 141, 164, 145, 40,103 The two rightmost digits are saved and the rest discarded thus. 20, 51, 62, 41, 64, 45, 40, 03 Now combine these into one number 2051624164454003 (The number now is treated as decimal) Now divide the number by box #3 , 8282 giving …247720862033.518836 This number is now divided by the number in the first box 8251 giving ….30023131.76990896086 This number is then multiplied by the number in the second box 2740 giving 82263381049.55055275 This is our serial number rounded up to 82263381050 In order to see the numbers it is necessary to open the floating point window by typing wf on the command line and then change the data window to long real by clicking of the byte on the line above the data window. I would expect the position of the windows are now important in that you must choose which numbers to divide and which to multiply. It was somewhat difficult to find so here is how I found it. Bpx Msvbvm!60__vbar8var Once Ice breaks F5 seven (7) times as the program runs through the code each character. Now F10 At xx:6608EF40 the call to xx:660ECA94 loads the octal number into the floating point stack until all 8 numbers are added making one long number. This happens at 660ECADD the FLD instruction Character by character is appended to the number. F10 until xx:661066E9 Call [eax], this call will put the first divisor 8282 into ST 0 and the number from our name 2051624164454003 into ST 1 If you step over it (F10) you end up At xx:66105E8C FDIVP St(1),St makes this 247720860233.518836 Put a bpx at 66105E8C and F5 this way you do not have to run through all the code again. This is the second divide number (8251) At xx:6610527A FILD again puts 8251 into St 0 and 247720860233.518836 into St 1 and is made 30023131.76990896086 The loop is again run and next time we hit xx:6610527A FILD puts 2740 into St 0 and 30023131.76990896086 into St 1 At 66105E50 FMULP St(1), St multiplies the two numbers giving us the serial 82263381049.55055275 in ST 0 which is then rounded off. Princess Serial Generation |
Princess' Tread (Princess Screen Numbers) (06-Mar-99 11:38:55) |