KeygenMe v2.0 by cybult, Solution by Bswap on 8-9-2002.

So let's start with some words how it is done and works. The keygenme was written by Cybult. He loves to play and swap with the bytes, you will see it when you discover the program yourself.

I started to fill some bytes in the memory witch are static, the bytes are written and are used for calculating. I place them in memory on WM_INITDIALOG.

.data

  		angel   db 'Nameless Angel !',0
.data?
		Buffer      dd  15000 dup (?)

.code

.if uMsg == WM_INITDIALOG

                  
                   XOR       EBX,EBX
                   MOV       EBX, 20h
                   MOV       EAX,3914017052                       
                   SUB       EBX,EBX                            
                   PUSH      0000359Dh                           
                   POP       ECX                                
                   MOV       EDX,2834880320                       
i004011DB:         MOV       dword ptr[EBX+Buffer],EAX                 
                   ADD       EAX,EDX                            
                   ADD       EBX,04h                             
                   DEC       ECX                                
                   JNZ       i004011DB                           
                   MOV       EAX,00000010h                       
                   MOV       EDX,0000359Eh                       
                   SHR       EAX,02h                             
                   CMP       EAX,EDX                            
                   JAE       i004011FF                           
                   LEA       EAX,dword ptr[EDX*2+EDX]                    
                   JMP       i00401202                           
i004011FF:         LEA       EAX,dword ptr[EAX*2+EAX]                    
i00401202:         MOV       EDI,EAX                            
                   SUB       EAX,EAX                            
                   SUB       EBX,EBX                            
                   SUB       ECX,ECX                            
                   SUB       EDX,EDX                            
i0040120C:         ADD       EAX,dword ptr[ECX*4+Buffer]               
                   ADD       EAX,EBX                            
                   ROL       EAX,03h                             
                   MOV       dword ptr[ECX*4+Buffer],EAX               
                   MOV       ESI,ECX                            
                   LEA       ECX, [EAX+EBX]                      
                   ADD       EBX,dword ptr[EDX*4+angel]               
                   ADD       EBX,EAX                            
                   ROL       EBX,CL                             
      	           MOV       ECX,ESI                            
                   MOV       dword ptr[EDX*4+angel],EBX               
                   INC       ECX                                
                   CMP       ECX,0000359Eh                       
                   JNZ       i00401243                           
                   SUB       ECX,ECX                            
i00401243:         MOV       ESI,00000010h                       
                   INC       EDX                                
                   SHR       ESI,02h                             
                   CMP       EDX,ESI                            
                   JNZ       i00401252                           
                   SUB       EDX,EDX                            
i00401252: DEC     EDI                                
                   JNZ        i0040120C 

After that I will give a sort explanation of the source after pressing the generate button in the key generator.


lus1:
              mov edi, dword ptr [Editbox1 - 2 + esi]
              sar edi,10h
              xchg ax, di
              or edi, 20011983h
              bswap edi
              btc eax, ebx
              xor bl,dl
              btc eax, ebx
              mov byte ptr [Editbox1 + esi], al               
              inc esi
              dec ecx
              jnz lus1				
             

In this piece of code the bytes of the name are increased with one or lowered with one.   

At line 5c74ca of the keygenme the bytes are read into the registers and calculated and twisted. Here is the piece of source code:
 

016F:005C74CA  55                  PUSH      EBP                                
016F:005C74CB  A178935C00          MOV       EAX,[005C9378]                     
016F:005C74D0  8B1D7C935C00        MOV       EBX,[005C937C]                     
016F:005C74D6  8B0D80935C00        MOV       ECX,[005C9380]                     
016F:005C74DC  8B1584935C00        MOV       EDX,[005C9384]                     
016F:005C74E2  2B0D2C6A5D00        SUB       ECX,[005D6A2C]                     
016F:005C74E8  2B05286A5D00        SUB       EAX,[005D6A28]                     
016F:005C74EE  BECD1A0000          MOV       ESI,00001ACD                       
016F:005C74F3  92                  XCHG      EAX,EDX                            
016F:005C74F4  87CB                XCHG      ECX,EBX                            
016F:005C74F6  87D3                XCHG      EDX,EBX                            
016F:005C74F8  8D2C5501000000      LEA       EBP,[EDX*2+00000001]               
016F:005C74FF  0FAFEA              IMUL      EBP,EDX                            
016F:005C7502  C1C505              ROL       EBP,05                             
016F:005C7505  8D3C5D01000000      LEA       EDI,[EBX*2+00000001]               
016F:005C750C  0FAFFB              IMUL      EDI,EBX                            
016F:005C750F  C1C705              ROL       EDI,05                             
016F:005C7512  87CF                XCHG      ECX,EDI                            
016F:005C7514  56                  PUSH      ESI                                
016F:005C7515  C1E603              SHL       ESI,03                             
016F:005C7518  81C6B8935C00        ADD       ESI,005C93B8                       
016F:005C751E  2B7E04              SUB       EDI,[ESI+04]                       
016F:005C7521  D3CF                ROR       EDI,CL                             
016F:005C7523  33FD                XOR       EDI,EBP                            
016F:005C7525  87CF                XCHG      ECX,EDI                            
016F:005C7527  2B06                SUB       EAX,[ESI]                          
016F:005C7529  87CD                XCHG      ECX,EBP                            
016F:005C752B  D3C8                ROR       EAX,CL                             
016F:005C752D  33C7                XOR       EAX,EDI                            
016F:005C752F  87CD                XCHG      ECX,EBP                            
016F:005C7531  5E                  POP       ESI                                
016F:005C7532  4E                  DEC       ESI                                
016F:005C7533  75BE                JNZ       005C74F3   
 
This is done for 6861 times, now you have to write a routine to go in the opposite direction. 
My piece of code looks like this.


                 MOV       ESI,00000001h
countback:       LEA       EBP, dword ptr [EDX*2+00000001]               
                 IMUL      EBP,EDX                            
                 ROL       EBP,05                             
                 LEA       EDI, dword ptr [EBX*2+00000001]               
                 IMUL      EDI,EBX                            
                 ROL       EDI,05
                 XCHG      ECX,EDI                                              
                 XOR       EDI,EBP
                 XOR       EAX,ECX
                 XCHG      EBP,ECX
                 ROL       EAX,CL
                 XCHG      EBP,ECX
                 ROL       EDI,CL
                 PUSH      ESI                                
                 SHL       ESI,03                             
                 ADD       ESI, OFFSET BUFFER                       
                 ADD       EDI,[ESI+04]
                 ADD       EAX,[ESI]
                 XCHG      ECX,EDI
                 POP       ESI   
                 INC       ESI             
                 XCHG      EDX,EBX
                 XCHG      ECX,EBX 
                 XCHG      EAX,EDX                  
               .if esi != 1ACEh
                 JMP countback
               .endif
		ADD       EAX, 1732cb1fh
                ADD       ECX, 30d46449h
                MOV       dword ptr [Editbox1] , eax                    
                MOV       dword ptr [Editbox1 + 4], ebx                    
                MOV       dword ptr [Editbox1 + 8], ecx                   
                MOV       dword ptr [Editbox1 +12], edx

Now we come to the joke of the whole routine there is a piece of code which is written for 5792253 times is takes over 1.6 MB of code, here is the source 1 time.

       		   bswap eax
                   push eax
                   sub eax, eax
                   or eax, 11111111h
                   xor edx, eax
                   pop eax
                   mov edx, eax
                   xchg edi, esi
                   or esi, edi
                   and eax, 0F0F0F0Fh
                   xor esi, eax
                   and edi, edx
                   sub si, di
                   xor edx, eax
                   rol eax, 08
                   add esi, esi
                   bswap edi
                   dec di
                   or eax, edx
                   add esi, eax
                   mov edx, eax
                   add edi, 83726AF1h
                   and eax, 33333333h
                   xor edx, eax
                   or edi, edx
                   rol eax, 04
                   sbb esi, edi
                   and esi, eax
                   or eax, edx
                   mov edx, eax
                   and eax, 55555555h
                   xor edx, eax
                   rol eax, 02
                   sar esi, cl
                   or eax, edx
                   xor edi, esi
                   ror eax, 07

This piece of code is revisable that means you put a number in register eax and it calculates an other one, but when you place it back it will give you the same old code. So you only have to use it only 1 time.

This code is placed at the last 8 bytes of the 16 bytes long key.

Than the 8 first bytes are calculated and at last the whole code is converted to ASCII.

A validate code is:
name:     bswap
checksum: B3D4812D645DBE438429AFD00AA97A39

If you have any comment or questions please mail,

goodwill80@hotmail.com

The usual disclaimer:
Whatever happens when you running this program, I
am not responsible for anything.

I want to greet everyone who knows me, and the guys who make the keygens and crackmes.
And Cybult, I think it is time to start on KeygenMe v3.0 by cybult ;)