home *** CD-ROM | disk | FTP | other *** search
/ KeyGen Studio 2002 / KeyGen_Studio_2002.iso / Tutorials / CrackMesCbjNet / nh-k4n3.ZIP / nh-k4n3.txt next >
Encoding:
Text File  |  2001-04-23  |  7.3 KB  |  194 lines
  1. K4N Crackme #3 keygen by nh
  2.  
  3. E-Mail: nh666@mail.ru
  4.  
  5. crackme is easy. this is commented listing from ida:
  6.   
  7. .text:004011F5               imul    eax, 3
  8. .text:004011F8               shl     eax, 2
  9. .text:004011FB               add     eax, 0CDh
  10. .text:00401200               mov     [ebp+number], eax
  11.  
  12. ; ((1a5h-0cdh) shr 2) div 3=12h =)
  13.  
  14. .text:00401203               cmp     [ebp+number], 1A5h
  15. .text:0040120A               jnz     BadKey
  16. .text:00401210               xor     eax, eax
  17. .text:00401212               mov     al, [ebp+key]
  18. .text:00401215               test    al, al
  19. .text:00401217               jz      short loc_0_40122C
  20. .text:00401219               lea     ecx, [ebp+key]
  21. .text:0040121C 
  22. .text:0040121C cycle1:                       ; CODE XREF: Check+CAj
  23. .text:0040121C               cmp     al, 30h
  24. .text:0040121E               jb      loc_0_4012EA
  25. .text:00401224               mov     al, [ecx+1]
  26. .text:00401227               inc     ecx
  27. .text:00401228               test    al, al
  28. .text:0040122A               jnz     short cycle1
  29. .text:0040122C 
  30. .text:0040122C loc_0_40122C:                   ; CODE XREF: Check+B7j
  31. .text:0040122C               call    null_regs
  32. .text:00401231               lea     eax, [ebp+name]
  33. .text:00401237               push    eax
  34. .text:00401238               call    get_number
  35. .text:0040123D               mov     [ebp+number], eax
  36. .text:00401240               call    null_regs
  37. .text:00401245               lea     ecx, [ebp+name]
  38. .text:0040124B               push    esi
  39. .text:0040124C               push    ecx
  40. .text:0040124D               call    clear_whore
  41. .text:00401252               add     esp, 0Ch
  42. .text:00401255               xor     ecx, ecx
  43. .text:00401257 
  44. .text:00401257 cycle2:                       ; CODE XREF: Check+124j
  45. .text:00401257               mov     eax, [ebp+number]
  46. .text:0040125A               xor     edx, edx
  47. .text:0040125C               mov     esi, 1Ah
  48. .text:00401261               div     esi
  49. .text:00401263               mov     dl, [ebp+edx+alphabet]
  50. .text:0040126A               mov     [ebp+ecx+generated], dl
  51. .text:0040126E               mov     eax, [ebp+number]
  52. .text:00401271               shl     eax, 3
  53. .text:00401274               mov     edx, 12345h
  54. .text:00401279               imul    eax
  55. .text:0040127B               add     eax, edx
  56. .text:0040127D               mov     [ebp+number], eax
  57. .text:00401280               inc     ecx
  58. .text:00401281               cmp     ecx, 12h
  59. .text:00401284               jb      short cycle2
  60. .text:00401286               call    null_regs
  61. .text:0040128B               xor     eax, eax
  62. .text:0040128D 
  63. .text:0040128D cycle3:                       ; CODE XREF: Check+142j
  64. .text:0040128D               mov     cl, [ebp+eax+key]
  65. .text:00401291               mov     dl, [ebp+eax+generated]
  66. .text:00401295               sub     cl, 30h
  67. .text:00401298               xor     dl, cl
  68. .text:0040129A               mov     [ebp+eax+generated], dl
  69. .text:0040129E               inc     eax
  70. .text:0040129F               cmp     eax, 12h
  71. .text:004012A2               jb      short cycle3
  72. .text:004012A4               call    null_regs
  73. .text:004012A9               lea     edx, [ebp+generated]
  74. .text:004012AC               push    edx
  75. .text:004012AD               call    xoring
  76. .text:004012B2               call    null_regs
  77. .text:004012B7               lea     eax, [ebp+generated]
  78. .text:004012BA               push    offset aKeygenning4new
  79. .text:004012BF               push    eax
  80. .text:004012C0               call    sub_0_401130
  81. .text:004012C5               add     esp, 0Ch
  82. .text:004012C8               test    eax, eax
  83. .text:004012CA               jnz     short GoodKey
  84. .text:004012CC 
  85. .text:004012CC BadKey:                       ; CODE XREF: Check+AAj
  86. .text:004012CC               mov     ecx, [ebp+arg_0]
  87. .text:004012CF               push    10h
  88. .text:004012D1               push    offset aError
  89. .text:004012D6               push    offset aBadSerialO
  90. .text:004012DB               push    ecx
  91. .text:004012DC               call    ds:MessageBoxA
  92.  
  93. .text:00401080 
  94. .text:00401080 ; ███████████████████████████████████████████████████████████████████████████
  95. .text:00401080 
  96. .text:00401080 ;           S u b r o u t i n e
  97. .text:00401080 ; Attributes: bp-based frame
  98. .text:00401080 
  99. .text:00401080 get_number      proc near           ; CODE XREF: Check+D8p
  100. .text:00401080 
  101. .text:00401080 var_4           = dword ptr -4
  102. .text:00401080 arg_0           = dword ptr  8
  103. .text:00401080 
  104. .text:00401080               push    ebp
  105. .text:00401081               mov     ebp, esp
  106. .text:00401083               push    ecx
  107. .text:00401084               push    ebx
  108. .text:00401085               push    esi
  109. .text:00401086               push    edi
  110. .text:00401087               push    offset aEheh
  111. .text:0040108C               push    0
  112. .text:0040108E               call    getdword
  113. .text:00401093               add     esp, 8
  114. .text:00401096               mov     ebx, eax
  115. .text:00401098               call    null_regs
  116. .text:0040109D               mov     edi, offset aIsAWhore_   ; %)))))))))))
  117. .text:004010A2               or      ecx, 0FFFFFFFFh
  118. .text:004010A5               xor     eax, eax
  119. .text:004010A7               repne scasb
  120. .text:004010A9               not     ecx
  121. .text:004010AB               sub     edi, ecx
  122. .text:004010AD               mov     esi, edi
  123. .text:004010AF               mov     edi, [ebp+arg_0]
  124. .text:004010B2               mov     edx, ecx
  125. .text:004010B4               or      ecx, 0FFFFFFFFh
  126. .text:004010B7               repne scasb
  127. .text:004010B9               mov     ecx, edx
  128. .text:004010BB               dec     edi
  129. .text:004010BC               shr     ecx, 2
  130. .text:004010BF               repe movsd
  131. .text:004010C1               mov     ecx, edx
  132. .text:004010C3               and     ecx, 3
  133. .text:004010C6               repe movsb
  134. .text:004010C8               xor     edi, edi
  135. .text:004010CA               xor     esi, esi
  136. .text:004010CC 
  137. .text:004010CC loc_0_4010CC:                   ; CODE XREF: get_number+76j
  138. .text:004010CC               mov     eax, [ebp+arg_0]
  139. .text:004010CF               push    eax
  140. .text:004010D0               push    esi
  141. .text:004010D1               call    getdword
  142. .text:004010D6               mov     ecx, arr[esi]
  143. .text:004010DC               add     esp, 8
  144. .text:004010DF               xor     ecx, edi
  145. .text:004010E1               add     eax, ecx
  146. .text:004010E3               mov     [ebp+var_4], eax
  147. .text:004010E6               rol     [ebp+var_4], 7
  148. .text:004010EA               mov     eax, [ebp+var_4]
  149. .text:004010ED               add     esi, 4
  150. .text:004010F0               xor     ebx, eax
  151. .text:004010F2               inc     edi
  152. .text:004010F3               cmp     esi, 40h
  153. .text:004010F6               jl      short loc_0_4010CC
  154. .text:004010F8               pop     edi
  155. .text:004010F9               mov     eax, ebx
  156. .text:004010FB               pop     esi
  157. .text:004010FC               pop     ebx
  158. .text:004010FD               mov     esp, ebp
  159. .text:004010FF               pop     ebp
  160. .text:00401100               retn    
  161. .text:00401100 get_number      endp
  162.   
  163. .text:00401110 
  164. .text:00401110 ; ███████████████████████████████████████████████████████████████████████████
  165. .text:00401110 
  166. .text:00401110 ;           S u b r o u t i n e
  167. .text:00401110 
  168. .text:00401110 xoring           proc near           ; CODE XREF: Check+14Dp
  169. .text:00401110 
  170. .text:00401110 arg_0           = dword ptr  4
  171. .text:00401110 
  172. .text:00401110               mov     ecx, [esp+arg_0]
  173. .text:00401114               xor     eax, eax
  174. .text:00401116 
  175. .text:00401116 loc_0_401116:                   ; CODE XREF: xoring+12j
  176. .text:00401116               mov     dl, [eax+ecx]
  177. .text:00401119               xor     dl, al
  178. .text:0040111B               mov     [eax+ecx], dl
  179. .text:0040111E               inc     eax
  180. .text:0040111F               cmp     eax, 12h
  181. .text:00401122               jb      short loc_0_401116
  182. .text:00401124               retn    
  183. .text:00401124 xoring           endp
  184. .text:00401124 
  185. .text:00401124 ; ───────────────────────────────────────────────────────────────────────────
  186.  
  187.  
  188.  
  189. keygen was written in Visual C++.
  190. that's all
  191.  
  192. /nh
  193.  
  194.