$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$


      ___   ___   ___   ___  ____
      /   \ /   \ /   \ /   \I_  /
     I  l  I  l  I  l  I  ___I  /
     I  l  I  l  I  l  I     I / _
      \____I  __/_\____I\___/l/___I
           I I  l  I    \
   member  I I  l  I     I  UnderPL
     of    I_I     I  l  I    2001
              \____I__l__I

     >>>> apacz@under-pl.org <<<<



$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

cel	: CrackMe 5.0 by Mr.Ketchup
data	: listopad 2001
napisal	: apacz^UnderPL
co	: tut

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

HOWGH!

Jest to moj pierwszy tut wiec sorki za bledy i moze zbyt lakoniczny opis
ale nie mam zdolnosci dydaktycznych~;-), ale mysle ze wszystko co tu na-
pisze bedzie zrozumiale.
Naszym celem jest CrackMe 5.0 by Mr.Ketchup, dloczego? Bo na Crackmes 4U
bylo jeszcze nie 'zrobione'~;), ale zacznijmy od poczatku.

Odpalamy nasz cel i co widzimy - trzeba wpisac Name i Code co czynimy.
Taak, ale co zrobic by nasze dane zatwierdzic? Moze 'AbouT'? Czytamy kto
zrobil i co mamy zrobic - przyciskamy 'OK' i juz mamy dwa nowe przyciski
Zatwierdzamy wciskajac 'Ok' i crackme sie zamyka~;) oczywiscie bo wpisa-
lismy zle dane, ale przynajmniej wiemy, ze nie ma zadnego messageBoxa.
Odpalamy Si pulapka na GetWindowTextA, odpalamy crackme, wpisujemy Name 
Code [musi miec minimum 8 znakow - sprawdz co sie bedzie dzialo gdy wpi-
szesz mniej~;)]
Program lapie sie dwa razy - na pobieraniu name i code.
Po drugim razie ladujemy tutaj:
[listing z IDA'y~;)]

CODE:00403BF3                 xor     esi, esi
CODE:00403BF5                 xor     edi, edi
CODE:00403BF7                 xor     eax, eax
CODE:00403BF9                 xor     edx, edx
CODE:00403BFB                 mov     esi, [ebp+lpString];name do esi
CODE:00403BFE                 mov     edi, [ebp+var_8]   ;code do edi
CODE:00403C01                 mov     eax, [esi]
CODE:00403C03                 ror     eax, 12h
CODE:00403C06                 xor     eax, 0BABADEADh
CODE:00403C0B                 rol     eax, 7
CODE:00403C0E                 sub     eax, [esi+4]
CODE:00403C11                 rol     eax, 15h
CODE:00403C14                 xor     eax, [esi]
CODE:00403C16                 add     eax, [edi]
CODE:00403C18                 sub     eax, [edi+3]
CODE:00403C1B                 xor     eax, [edi+2]
CODE:00403C1E                 imul    eax, [edi+1]
CODE:00403C22                 sub     eax, [edi]
CODE:00403C24                 mov     ebx, [edi+3]
CODE:00403C27                 ror     ebx, 0Ch
CODE:00403C2A                 add     ebx, [edi]
CODE:00403C2C                 xor     ebx, eax
CODE:00403C2E                 add     ebx, [edi+2]
CODE:00403C31                 add     ebx, 6D40D80h
CODE:00403C37                 sub     eax, 0Dh
CODE:00403C3A                 cmp     eax, ebx
CODE:00403C3C                 jnz     loc_403A78       ; BadBoy:-P
CODE:00403C42                 push    40h
CODE:00403C44                 push    offset dword_403C68
CODE:00403C49                 push    offset dword_403C70
CODE:00403C4E                 mov     eax, ds:hWndParent
CODE:00403C53                 push    eax
CODE:00403C54                 call    MessageBoxA_0


Programok robi tu spor dzialan w wyniku czego wartosci eax i ebx musza 
byc rowne, jesli nie to program sie zamyka. Nie potrafie odwrocic tej 
procki wiec postanowile napisac brute force.[pierwszy moj tut i pierwsze
brute force~;)] W pisaniu jego bardzo pomogl mi tut barta na ten temat i
zrudelka jego 'bf'-ow [dzieki bart~;)]
Oto co mi wyszlo:


;##########################################################
;Jest to moje pierwsze brute force, ktorego szkielet zostal
;oparty na zrudelkach barta^xt. Dzieki~;-)
;Brute Force do CrackMe 5.0 by Mr.Ketchup
;##########################################################
.386
.model flat,stdcall

include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
include \masm32\include\advapi32.inc
include \masm32\include\windows.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
includelib \masm32\lib\advapi32.lib


.data
            lpSN    db 64 dup(?)
            lpName  db 'apacz^UnderPL','$'
            _seed   dd 3875398


.code
_start:
            int 3
            cld

next:
            mov     esi, 0
            mov     edi, 0
            mov     eax, 0
            mov     edx, 0
            mov     esi,offset lpName
            mov     edi,offset lpSN
            mov     ecx, 8
gen_SN:            
            call    rnd
            mov     [edi+ecx-1],al
            dec     ecx
            jne     gen_SN
            
            mov     eax, [esi]
            ror     eax, 12h
            xor     eax, 0BABADEADh
            rol     eax, 7
            sub     eax, [esi+4]
            rol     eax, 15h
            xor     eax, [esi]
            add     eax, [edi]
            sub     eax, [edi+3]
            xor     eax, [edi+2]
            imul    eax, [edi+1]
            sub     eax, [edi]
            mov     ebx, [edi+3]
            ror     ebx, 0Ch
            add     ebx, [edi]
            xor     ebx, eax
            add     ebx, [edi+2]
            add     ebx, 6D40D80h
            sub     eax, 0Dh
            cmp     eax, ebx
            jnz     next


		push	0
		call	save_file
		db	'out.bin'
		save_file:
		call	_lcreat
		xchg	eax,ebx

		push	64
		push	offset lpSN
		push	ebx
		call	_lwrite

		push	ebx
		call	_lclose

		push	0
		call	ExitWindowsEx


		int 3


rnd		proc near
	pushad
next_random:
	call	GetTickCount
	xor	eax,[_seed]		; Move bits 31-0 of old seed to EAX
					; Move bits 38-32 of old seed to DL, set DH = 0
	movzx	edx, byte ptr [_seed+4]
					; Shift bits 32-1 to bits 31-0
	shrd	eax, edx, 1
	mov	dword ptr[_seed], eax	; Save bits 31-0 of new seed
	adc	dh, 0			; DH = bit shifted out of EAX
	shr	dl, 1			; Shift bits 38-33 of old seed to bits 37-32
	mov	cl, dl			; Get bit 35 of old seed to the lsb of CL
	shr	cl, 2
	and	cl, 1			; CL = bit 35 of old seed
	xor	dh, cl			; xor it with old bit 0
	shl	dh, 6
	or	dl, dh			; store it in bit 38 ...
	mov	byte ptr [_seed+4],dl	; ... of new seed

	mov	ecx,lAllowed
	sub	edx,edx
	div	ecx
	mov	al,byte ptr[edx+szAllowed]
	mov	[esp+28],eax

	popad
	ret

rnd	endp

;szAllowed	db "!@#$%^&*()_+-=/?\ ,.|1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz{}|~[]_^'"
;szAllowed	db "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ{}|~[]_^'"
szAllowed	db 'abcdefghijklmnopqrstuvwxyz ,.'

;szAllowed	db '01234567890ABCDEF'

;szAllowed	db '0123456789'
lAllowed	equ $-szAllowed


end _start



Wlasciwych rozwiazan jest oczywiscie wiele dla jednego Name~;)
Dla apacz^UnderPL jeden z kodow to: y,s.uxaw

I to by bylo na tyle ~;-)


Do nastepnego tuta 

apacz^UnderPL [apacz@under-pl.org]

2001.11.13