Download whole package here! (includes tutorial, crackme and bruteforcer).

So, today we crack a nice easy key crackme. When you run the file from the console, it wants you type in a key. Enter a random key and you get the message "Wrong serial" followed by another try to enter a valid key. Also note that you you don't have to type in a name, just a key.

Open the file in Ollydbg, right-click in the main window and choose 'Search for' -> 'All referenced text strings'. In the new window which pops up double-click 'Key: ' cause after this string is printed to the console, you have to enter the key, so this should be the right place. You land at 4013C7. When you scroll some pages down. you see several checks and at 4015E1 the good 'Well done' message. Ok, seems to be the right place.
So set a breakpoint, for example at 4013EA, run the crackme, enter a key and trace the code with F8. If you come to a condition your key doesn't fulfill, just re-run the crackme and enter a key that matches the condition.

Condition 1:

Easy. Our key must exactly be 0x10 = 16 characters long. Ok, let's go on...

Condition 2:

You'll come across several calls to keyme.004178AC. This just returns the desired single character of entered key. Here 0 is pushed as arg2 so it returns the first character, let's call it key[0]. So key[0] must be greater than 0x40 = '@' and less than or equal 0x5A = 'Z'. In other words, first character must a capital letter ('A'...'Z').

Condition 3:

So key[11] must be 0x20, that means it must be a space. Ok, let's go on...

Condition 4:

So key[8] must be 0x2E, that means a dot ('.'). Till now the key must look like "Xxxxxxxx.xx xxxx".

Condition 5:

So in this loop, the ascii values of the first eleven characters of the entered key are added. The sum of these values is stored on the stack at [EBP-24]. So key[0] + key[1] + ... + key[10] must be 0x3F3 (= 1001 decimal).

Condition 6:

Well, this loop is quite analog to the previous one. Here the ascii values from the last four values are added and stored on the stack at [EBP-28]. That means key[12] + key[13] + key[14] + key[15] must be 0x1D1 (=465 decimal). A valid key till now for example would be "Addddddd.dd tttu".

Condition 7:

This code snippet checks if the last character is the same as the character before the last character. That means key[14] must be equal to key[15].

Condition 7:

Obviously key[13] must be 0x6F which is 'o'.

Condition 8:

Here it is checked if key[12] is equal to the value of [EBP-24]. If you look a bit above at 401507, you see that the value 0x72 is moved to [EBP-24] and is never changed. So key[12] must be 0x72 = 'r'.
So till now a valid key would be "Addddddd.dd roxx" cause the 'r' and 'o' are fixed, both last characters must be same and the sum of the last four characters must be 0x1D1.
(0x1D1 - 0x6F - 0x72) / 2 = 0x78 = 'x'.

Condition 9:

The 3rd character must be between 0x30 = '0' and 0x39 = '9', so it must be number.

Condition 10:

This code snippet gets the 2nd and the 13th character and checks if they are equal. So key[1] must be key[12]. As we know from condition 12 that key[12] must be 'r', key[1] must also 'r'.

Summary

Ok, these were all conditions. Here is a summary of them (note I represent the key as key[0]...key[15]:

Well, as the author states, there are a lot of keys which satisfy the conditions. The first valid key I constructed with pen&paper and a ascii table was "Ar9nnggg.dd roxx". But he also said in the readme file that you can recognize the right key. After some looking at my first key, suddenly "Crackmes.de roxx" came into my mind. But the third character must be a number, so some easy calculating leads us to "Cr4ckmes.de roxx". I think that's the right one.

I also coded a little bruteforcer which calculate tons of valid keys. You find it inside the zip package.

Hopefully the crackme was fun for you and you learned something :-)

Sunshine, May 2k7

This site is part of Sunshine's Homepage