Friday, September 5, 2008

Reverse engineering on Linux :: CrackMe (1)

The CrackMe is here :: http://www.crackmes.de/users/libertyordeath/libertyordeaths_keygenme_3/

0x8048a18 --> anti-debug
0x80489b0 --> serial can be sniffed from EAX.

name hash is generated here ::

=========================================
0x80488b6 : shl DWORD PTR [ebp-0x220],1 <----- shift.left 0x80488bc : add esi,0x1
0x80488bf : movzx eax,BYTE PTR [esi+ebp*1-0x10f]
0x80488c7 : test al,al
0x80488c9 : je 0x80488de
0x80488cb : test esi,0x1
0x80488d1 : je 0x80488b6
0x80488d3 : movsx eax,al
0x80488d6 : mov DWORD PTR [ebp-0x220],eax
0x80488dc : jmp 0x80488b6
=========================================


hostname hash is generated here ::

=================================================================
0x80488e0 : mov DWORD PTR [ebp-0x224],0x0
0x80488ea : jmp 0x8048904
0x80488ec : lea esi,[esi+eiz*1+0x0]
0x80488f0 : test bl,0x1
0x80488f3 : jne 0x8048901
0x80488f5 : imul eax,ebx <------------
0x80488f8 : imul eax,esi <------------
0x80488fb : mov DWORD PTR [ebp-0x224],eax
0x8048901 : add ebx,0x1
0x8048904 : mov eax,ds:0x80494e4
0x8048909 : mov DWORD PTR [esp],eax
0x804890c : call 0x8048574 <_io_getc@plt>
0x8048911 : cmp eax,0xa
0x8048914 : jne 0x80488f0
===================================================================

Keygen ::


#include "stdio.h";
#include "string.h";

int main ()
{
 char name[30];
 char hostname[30];

 int  i;
 int name_hash;
 int host_hash;

 printf("\n[?] Input name : ");
 scanf("%s",name);

 printf("[?] Input hostname : ");
 scanf("%s",hostname);

 for (i=0;i<strlen(name);i+=2)
 {
  name_hash = name[i] * i * strlen(hostname);
 }

 for (i=1;i<strlen(hostname);i+=2)
 {
  host_hash = hostname[i] << 2;
 }

 printf("\n>>> serial = %d-",name_hash+host_hash);

 for (i=0;i<strlen(hostname);i+=2)
 {
  putchar(hostname[i]);
 }

 printf("\n\n");
 return 0;
}

Writing tutorial is very boring, yet if anyone wants to know any detail, drop me a line. I'll try to explain. The CrackMe was not very difficult anyway.