Cracking Projects For Newbies

Re: Project 6(Calculation Routine) Tuesday, 09-Feb-99 15:45:25 209.52.161.176 writes: Calculation Routine: Lets see if I understand what's going on here....correct me if I'm wrong. I've notice something that I don't think is important, but interesting. If you enter a name that is longer than 8 charaters(as we did) then the first 8 characters are stored into [ebp+ebx-4a] and the remaining is then xored with those first 8 characters. EX: Pirate Copy (11 characters long) - Pirate C(the first 8 characters) is stored into [ebp+ebx-4a] - opy(the remaining characters) is then xored with 'Pirate C' - 'o' xored 'P' = 6F xored 50 - 'p' xored 'i' = 70 xored 69 - 'y' xored 'r' = 79 xored 72 *cuz there is no more letters left, 0 is substituted in* - '0' xored 'a' = 0 xored 61 - '0' xored 't' = 0 xored 74 - '0' xored 'e' = 0 xored 65 - '0' xored ' ' = 0 xored 20 - '0' xored 'C' = 0 xored 43 to give you your new 8 bytes - 3F 19 0B 61 74 65 20 43 Now if you entered 8 characters or less then those characters with be the new bytes and the xored caluculation will be ignored. EX: Pirate(6 characters long) - Pirate is stored into [ebp+ebp-4a] - that's only 6 characters so 0's are added to make 8 characters. so now your new 8 bytes will be - 50 69 72 61 74 65 00 00 Okay... Once you have your 8 bytes they are made into 00's, or 01's. They are manipulated, moved around several times to give you a final set of 00's and 01's. When I first got to this stage I didn't understand what the hell was going on. Thanks to 'Princess' for her tutorial on the calculation routine. It helped alot to understand what the programmer was doing. It then enters a loop at :409504 - :4095C1 where each time it goes around this loop(4x) it takes a byte(00 or 01) and do some calculation and stores it into dl. After it executed the loop 4x the value of dl = 0D. There is then a cmp instruction to see wether 37 or 30 will be then added to dl. In this loop 37 is added giving us a new value of 44 = D our first character in our serial. There is then another loop at :40953D - :409556 where this loop takes the bytes 5, 6, 7, 8. It does the same calculation as the first loop and stores it into al. After it executed the loop 4x the value of al = 0. There is then the same cmp instruction to see wether 37 or 30 will be added. In this loop 30 is added giving us a new value of 30 = 0 our second character in our serial. These loops are done 8 times each to give us our serial number - D06E1DA1260D6605 I have a question: in the loop :409504 - :4095C1 there is a command 'SHL' what does this do? ex: bl = 1, cl = 3 (before) :409516 D2E3 shl bl, cl bl = 8 (after) Phil

Message thread:

Phil: Project 6 (n/t) (09-Feb-99 15:40:08)

Phil: Re: Project 6(Calculation Routine) (09-Feb-99 15:45:25)

HarvestR: the SHL instruction (09-Feb-99 17:10:02)
Princess: Re: Re: Project 6(Calculation Routine) (09-Feb-99 20:49:06)

Snuffy: Princess, you forgot some 0's (09-Feb-99 21:47:26)

Re: Princess, you forgot some 0's (09-Feb-99 22:59:36)

Re: Re: Project 6(Calculation Routine) (09-Feb-99 21:56:40)

Phil: Re: SHL command (10-Feb-99 01:24:17)

Henry: Re: Re: Project 6(Calculation Routine) (11-Feb-99 18:40:31)

Back to main board

Message subject: Name: (optional) Email address: (optional) Type your message here:

Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.