.386 .MODEL flat,stdCALL option casemap:none assume fs:nothing INClude \masm32\INClude\windows.INC INClude \masm32\INClude\user32.INC INClude \masm32\INClude\kernel32.INC INClude \masm32\INClude\gdi32.INC INClude \masm32\INClude\comdlg32.INC INClude \masm32\INClude\masm32.INC INClude \masm32\INClude\comctl32.INC INClude \MASM32\INCLUDE\shell32.INC INClude \masm32\INClude\PDBS.INC INCludelib \masm32\lib\user32.lib INCludelib \masm32\lib\kernel32.lib INCludelib \masm32\lib\gdi32.lib INCludelib \masm32\lib\comdlg32.lib INCludelib \MASM32\LIB\Comctl32.lib INCludelib \masm32\lib\masm32.lib INCludelib \MASM32\LIB\shell32.lib DlgProc PROTO :DWORD,:DWORD,:DWORD,:DWORD Aboutproc PROTO :DWORD,:DWORD,:DWORD,:DWORD OpenPEFile PROTO :DWORD,:DWORD ClosePEFile PROTO :DWORD UnmapFiLEAndHold PROTO :DWORD MapFile PROTO :DWORD .DATA Buttclass db "BUTTON",0 EDItclass db "EDIT",0 RGN db "RGN",0 RGN1 db "RGN1",0 ID_Exit equ 2086 ID_About equ 2087 ID_Gen equ 2088 ID_Copy equ 2084 caption db "Gregory Braun's Universal KeyMaker",0 No_Name db "Minimum one character !",0 not_pe db "Not a valid PE file",0 error_open db "No file loaded",0 not_found db "No Key founded",0 PasGlop db "Magic Number not active",0 Found_magic db "Magic Number founded",0 FilterString db "Executables Files",0,"*.exe",0 db "All Files",0,"*.*",0,0 format db "%u",0 ; conversion in decimal not signed string1 db 23h, 73h, 65h, 72h, 42h, 26h, 6Eh, 7Ah db 7Ch, 6Dh, 66h, 4Dh, 31h, 2Fh, 35h, 28h, 21h, 73h, 64h, 24h, 4Dh, 71h, 2Eh, 7Bh db 73h, 5Dh, 2Bh, 73h, 46h, 6Ah, 74h, 4Bh, 70h, 7Ah, 53h, 64h, 74h, 7Ah, 6Fh, 58h db 71h, 6Dh, 62h, 5Eh, 41h, 6Ch, 40h, 64h, 76h, 3Ah, 73h, 3Fh, 78h, 2Fh, 00 string2 db 7Ch, 62h, 21h, 70h, 7Ah, 2Ah, 6Ch, 73h, 3Bh, 72h, 6Eh, 7Ch, 6Ch, 66h, 24h, 76h db 69h, 5Eh, 41h, 78h, 70h, 65h, 29h, 72h, 78h, 35h, 61h, 69h, 63h, 26h, 39h, 2Fh db 32h, 6Dh, 35h, 6Ch, 73h, 69h, 34h, 40h, 30h, 64h, 6Dh, 5Ah, 77h, 39h, 34h, 63h db 6Dh, 71h, 70h, 66h, 68h, 77h, 00 magic db 8Bh, 44h, 24h, 04h, 56h, 8Bh, 35h, 00 ; chain to be founded key_tmp DWORD 0 buffer_tmp DWORD 0 Flag_PE DWORD 0 maphandle DWORD 0 map_ptr DWORD 0 size_of_file DWORD 0 entry DWORD 0 ImageBase DWORD 0 magic_nb DWORD 0 size_of_name DWORD 0 ; structure ofn OPENFILENAME <> PEFILE struct pBase DWORD ? hFile HANDLE ? hMap HANDLE ? PEFILE ends .DATA? @name dd 80 dup (?) @comp dd 80 dup (?) Key dd 80 dup (?) Directory db 512 dup (?) PE_File db 512 dup (?) temp dd ? compteur db ? desktopDC dd ? isCapture db ? hEDIt dd ? hEDItDC dd ? hEDItDC2 dd ? hInst dd ? hRGN dd ? hRGN2 dd ? hRGN4 dd ? hRGN6 dd ? hResource dd ? ResourcESIze dd ? CursorPos POINT <?> CursorPos2 POINT <?> RectRgn RECT <?> .CODE start: INVOKE GetModuleHandle, 0 MOV hInst, EAX INVOKE DialogBoxParam,EAX, 100, 0, DlgProc,0 INVOKE ExitProcess, 0 DlgProc proc hDlg:DWORD,uMsg:DWORD,wParam:DWORD,lParam:DWORD LOCAL stEnum[8]:BYTE ; 4 for RVA, 4 for RETurn value .IF uMsg==WM_COMMAND MOV EAX,wParam .IF ax==6001 INVOKE DialogBoxParam,hInst, 102, 0, Aboutproc,0 .ENDIF .IF ax==6002 CALL OpenDialog .IF EAX == 0 INVOKE SetDlgItemText,hDlg,103,OFFSET error_open RET .ENDIF PUSHAD INVOKE CreateFile, ADDR Directory, GENERIC_READ/ or GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL PUSHAD INVOKE GetFileSize,EAX,NULL MOV DWORD PTR [size_of_file], EAX POPAD INVOKE OpenPEFile,ADDR Directory,ADDR PE_File CMP EAX,0 JE not_valid_pe .IF EAX == 2 INVOKE SetDlgItemText,hDlg,103,OFFSET not_found POPAD RET .ENDIF POPAD MOV BYTE PTR [Flag_PE],01 INVOKE SetDlgItemText,hDlg,103,OFFSET Found_magic RET not_valid_pe: POPAD INVOKE SetDlgItemText,hDlg,103,OFFSET not_pe MOV BYTE PTR [Flag_PE],00 XOR EAX,EAX .ENDIF .IF ax==6003 .IF [Flag_PE] == 01 PUSHAD MOV DWORD PTR [key_tmp],0 INVOKE RtlZeroMemory,OFFSET @name,1264 INVOKE GetDlgItemText,hDlg,102,OFFSET @name,80 ; Get 80 char maxi MOV DWORD PTR[size_of_name],EAX CMP EAX, 00 ; name minimum one character JLE no_gen LEA EBX, OFFSET @name CALL generator INVOKE GetDlgItemText,hDlg,104,OFFSET @comp,80 MOV DWORD PTR[size_of_name],EAX CMP EAX,0 ; field "compagny" empty ? JE no_comp LEA EBX, OFFSET @comp CALL generator no_comp: INVOKE wsprintfA,ADDR Key,ADDR format,DWORD PTR [key_tmp] ; conversion HEX 2 ASCII .IF EAX == 0 INVOKE SetDlgItemText,hDlg,103,OFFSET PasGlop .ELSE INVOKE SetDlgItemText,hDlg,103,OFFSET Key .ENDIF POPAD RET no_gen: INVOKE SetDlgItemText,hDlg,103,OFFSET No_Name .ELSE INVOKE SetDlgItemText,hDlg,103,OFFSET PasGlop .ENDIF .ENDIF .IF ax==6004 INVOKE ExitProcess,NULL .ENDIF ;-------- Gestion des déplacements de la DialogBox ----------- ;-------- Extrait d'un source de Libthium ----------- .ELSEIF uMsg==WM_MOUSEMOVE .IF isCapture==TRUE INVOKE InvertRgn,desktopDC,hRGN2 INVOKE DeleteObject,hRGN2 INVOKE CreateRectRgn,0,0,1,1 MOV hRGN2,EAX INVOKE CombineRgn,EAX,hRGN,EAX,5 INVOKE GetCursorPos,OFFSET CursorPos2 MOV EAX,CursorPos2.x SUB EAX,CursorPos.x MOV EDX,CursorPos2.y SUB EDX,CursorPos.y INVOKE OffsetRgn,hRGN2,EAX,EDX INVOKE InvertRgn,desktopDC,hRGN2 .ENDIF .ELSEIF uMsg==WM_LBUTTONUP .IF isCapture==TRUE INVOKE InvertRgn,desktopDC,hRGN2 INVOKE GetRgnBox,hRGN2,OFFSET RectRgn SUB RectRgn.left,5 SUB RectRgn.top,38 INVOKE MoveWindow,hDlg,RectRgn.left,RectRgn.top,400,350,1 INVOKE DeleteObject,hRGN2 INVOKE ReleaseCapture MOV isCapture,FALSE .ENDIF .ELSEIF uMsg==WM_CTLCOLOREDIT INVOKE SetTextColor,wParam,0C0C0C0h INVOKE SetBkColor,wParam,Black INVOKE GetStockObject,BLACK_BRUSH RET .ELSEIF uMsg==WM_LBUTTONDOWN INVOKE UpdateWindow,hDlg INVOKE GetCursorPos,OFFSET CursorPos INVOKE CreateRectRgn,0,0,1,1 MOV hRGN2,EAX INVOKE CombineRgn,EAX,hRGN,EAX,5 INVOKE GetDesktopWindow INVOKE GetWindowDC,EAX MOV desktopDC,EAX INVOKE InvertRgn,desktopDC,hRGN2 MOV isCapture,TRUE INVOKE SetCapture,hDlg .ELSEIF uMsg==WM_CLOSE INVOKE PostQuitMessage,0 .ELSEIF uMsg==WM_INITDIALOG ; création des boutons INVOKE BmpButton,hDlg,287, 30,200,203,6001 ; About INVOKE BmpButton,hDlg,318, 83,202,201,6002 ; Search INVOKE BmpButton,hDlg,320,140,204,205,6003 ; Serial INVOKE BmpButton,hDlg, 58,118,206,207,6004 ; Exit INVOKE FindResource, 0, 170, OFFSET RGN MOV hRGN, EAX INVOKE LoadResource, 0, EAX MOV hResource, EAX INVOKE SizeofResource, 0, hRGN MOV ResourcESIze, EAX INVOKE LockResource, hResource MOV hResource, EAX INVOKE ExtCreateRegion, 0, ResourcESIze, hResource MOV hRGN, EAX INVOKE SetWindowRgn, hDlg, hRGN, TRUE INVOKE SendDlgItemMessage,hDlg,102,EM_LIMITTEXT,21,0 .ELSE XOR EAX,EAX RET .ENDIF @endmsg: or EAX,-1 RET DlgProc endp ;---------------affichage de la boite ABOUT---------------------- Aboutproc proc hwin:DWORD,uMsg:DWORD,wParam:DWORD,lParam:DWORD .IF uMsg==WM_COMMAND MOV EAX,wParam .IF ax==6005 INVOKE EndDialog,hwin,0 RET .ENDIF .ELSEIF uMsg==WM_CLOSE INVOKE PostQuitMessage,0 .ELSEIF uMsg==WM_INITDIALOG INVOKE BmpButton,hwin,85,108,208,209,6005 ; Exit INVOKE FindResource, 0, 171, OFFSET RGN MOV hRGN4, EAX INVOKE LoadResource, 0, EAX MOV hResource, EAX INVOKE SizeofResource, 0, hRGN4 MOV ResourcESIze, EAX INVOKE LockResource, hResource MOV hResource, EAX INVOKE ExtCreateRegion, 0, ResourcESIze, hResource MOV hRGN4, EAX INVOKE SetWindowRgn, hwin, hRGN4, TRUE .ELSE XOR EAX,EAX RET .ENDIF @endmsg: or EAX,-1 RET Aboutproc endp ;---------------------Generateur de code------------------------- generator proc MOV DWORD PTR [buffer_tmp],0 ; erase memory MOV ESI, DWORD PTR [magic_nb] ; stock magic number CMP ESI, 00 JE no_magic or ESI,00000378h ; beginning of the generator PUSH ESI PUSH EBP LEA ESI, OFFSET string2 XOR EDX,EDX XOR EDI,EDI INC EDI SUB ESI,EBX MOV ECX,EBX SUB EDI,EBX loop1: MOVSX EBX,BYTE PTR [ECX+ESI] ; EBX = 1 char of the 2d chain MOVSX EBP,BYTE PTR [EDX+EAX+string1] ; EBP = 1 char of the 1st chain IMUL EBX,EBP ; EBX x EBP (7C x 7C = 3C10) LEA EBP,[ECX+EDI] ; EBP is a pointer IMUL EBX,EBP ; 3C10 x 1 MOVSX EBP,BYTE PTR [ECX] ; 1 char of the name entered IMUL EBX,EBP ; 3C10 x 63 = 173A30 -> in EBX MOV EBP,DWORD PTR [buffer_tmp] ; previous result in EBP ADD EBP,EBX ; add previous result at EBX INC EDX ; Inc the pointer INC ECX ; next character of the name CMP EDX,EAX ; pointer = size of name ? MOV DWORD PTR [buffer_tmp],EBP ; résult calculated above is stored JL loop1 ; loop on next character MOV EAX,EBP ; EAX = 1st serial calculated (in hexdécimal) POP EBP POP ESI CMP DWORD PTR [@comp],0 ; if the field "compagny" is empty JNE no_ADD ; magic number not added a 2d time ADD EAX,ESI no_ADD: ADD DWORD PTR [key_tmp],EAX XOR EAX, EAX INC EAX RET no_magic: XOR EAX, EAX RET generator endp ;---------------------------- Brownse ----------------------------------- OpenDialog PROC hWin:DWORD INVOKE RtlZeroMemory,OFFSET key_tmp,80h ; erase memory CMP DWORD PTR [Directory],0 ; if a file is already open JE @F INVOKE ClosePEFile, ADDR PE_File ; UnMap the file MOV DWORD PTR [Flag_PE], 0 @@: MOV [Directory],00 ; erase memory MOV ofn.lStructSize, SIZEOF ofn MOV ofn.lpstrFilter, OFFSET FilterString MOV ofn.lpstrFile, OFFSET Directory MOV ofn.nMaxFile, 512 MOV ofn.Flags, OFN_FILEMUSTEXIST or \ OFN_PATHMUSTEXIST or OFN_LONGNAMES or\ OFN_EXPLORER or OFN_HIDEREADONLY INVOKE GetOpenFileName, OFFSET ofn ; open the box "OpenFile" CMP EAX, FALSE ; stores info in structure ofn JNZ EndOD XOR EAX,EAX RET EndOD: RET OpenDialog ENDP ;--------------contrôle que le fichier est un exécutable------------------ OpenPEFile proc szName:DWORD, pPEFile:DWORD LOCAL stEnum[8]:BYTE ; 4 for RVA, 4 for RETurn value .IF ( EAX == INVALID_HANDLE_VALUE ) ; no handle returned by OpenFileName XOR EAX,EAX RET .ENDIF MOV ECX, pPEFile MOV (PEFILE ptr [ECX]).hFile, EAX INVOKE MapFile, pPEFile .IF ( !EAX ) XOR EAX,EAX RET .ENDIF MOV EAX, DWORD PTR [pPEFile] MOV ECX, [EAX] .IF ( WORD PTR [ECX] != 'ZM' ) ; DOS header? XOR EAX,EAX RET .ENDIF MOV EDI, ECX MOV DWORD PTR [entry],EDI PUSH EDI ; push beginning address of the target MOV EAX, pPEFile MOV EAX, (PEFILE ptr [EAX]).pBase ADD EAX, (IMAGE_DOS_HEADER ptr [EAX]).e_lfanew .IF ( WORD PTR [EAX] != 'EP' ) ; PE header? XOR EAX,EAX RET .ENDIF ; recherche de la combinaison ; --------------------------- MOV ECX, DWORD PTR [size_of_file] ; size of target file POP EDI ; beginning address of the target MOV al, 90h ; 1st value to found loop2: REPNZ SCASB TEST ECX, ECX ; si ECX =0 -> all the file as been seen JNE found1 MOV EAX,2 ; and the value not founded RET ; SCAS as found a 90h found1: XOR EDX,EDX ; pointer = 0 loop3: MOV bl, BYTE PTR [magic+EDX] ; pointe on next value of the chain searched CMP BYTE PTR [EDI+EDX],bl ; if not egual EDI+pointer JNE loop2 ; found a other value 90h INC EDX ; inc pointer CMP EDX,07 ; all value have been seen ? JNE loop3 ; verify next value ; récupération de l'adresse ;-------------------------- ADD EDI, 07 ; pointe on the @ where the magic number is initialized MOV ESI, DWORD PTR [EDI] ; get back the adresse MOV DWORD PTR [buffer_tmp], ESI ; remember the address MOV ECX, DWORD PTR [size_of_file] ; beguin again a scan MOV EDI, DWORD PTR [entry] ; in search of this address in the target MOV al, BYTE PTR [buffer_tmp] loop4: REPNZ SCASB TEST ECX, ECX JNE found2 XOR EAX,EAX RET found2: XOR EDX,EDX loop5: MOV bl, BYTE PTR [buffer_tmp+1+EDX] CMP BYTE PTR [EDI+EDX],bl JNE loop4 INC EDX CMP EDX, 03 JNE loop5 CMP WORD PTR [EDI-3], 05C7h ; verify that it is indeed about the good line JNE loop4 ; récupération de la clé ;----------------------- MOV EAX, DWORD PTR [EDI+3] ; get back the magic number MOV DWORD PTR [magic_nb],EAX ; remember it MOV EAX,1 RET OpenPEFile endp ;------------------------------------------------------------------------- ClosePEFile proc pPEFile:DWORD INVOKE UnmapFiLEAndHold, pPEFile MOV EAX, pPEFile INVOKE CloseHandle, (PEFILE ptr [EAX]).hFile ; close the Handle of the current target file RET ClosePEFile endp ;------------------------------------------------------------------------- UnmapFiLEAndHold proc pPEFile:DWORD MOV ECX, pPEFile INVOKE UnmapViewOfFile, DWORD PTR [ECX] ; UnMap the target file MOV ECX, pPEFile INVOKE CloseHandle, (PEFILE ptr [ECX]).hMap RET UnmapFiLEAndHold endp ;------------------------------------------------------------------------- MapFile proc pPEFile:DWORD MOV EAX, pPEFile MOV EAX, (PEFILE ptr [EAX]).hFile INVOKE CreateFileMapping, EAX, NULL, PAGE_READWRITE, 0, 0, NULL .IF ( !EAX ) MOV EAX, pPEFile INVOKE CloseHandle, (PEFILE ptr [EAX]).hFile RET .ENDIF MOV ECX, pPEFile MOV (PEFILE ptr [ECX]).hMap, EAX MOV maphandle,EAX INVOKE MapViewOfFile, EAX, FILE_MAP_READ or FILE_MAP_WRITE, 0, 0, 0 .IF ( !EAX ) MOV EAX, pPEFile INVOKE CloseHandle, (PEFILE ptr [EAX]).hMap INVOKE CloseHandle, (PEFILE ptr [EAX]).hFile RET .ENDIF MOV ECX, pPEFile MOV (PEFILE ptr [ECX]).pBase, EAX MOV map_ptr,EAX RET MapFile endp end start