To find where the Name / Serial is checked: bpx GetWindowTextA
It builds the string:
[Name][emaN][SOFTWARE\Microsoft\Windows\CurrentVersion\Productid][...\RegisteredOwner]
That is to say:
AmenesiaaisenemA22224-242-2222322-2222122224-242-2222322-22221
(the second regkey doesn't exist under some WinXX )
Then the program use :
text:00401560 IniHash
proc near
_text:00401560
_text:00401560
mov eax, [esp+arg_0]
_text:00401564
mov dword ptr [eax], 67452301h
_text:0040156A
mov dword ptr [eax+4], 0EFCDAB89h
_text:00401571
mov dword ptr [eax+8], 98BADCFEh
_text:00401578
mov dword ptr [eax+0Ch], 10325476h
_text:0040157F
retn
_text:0040157F IniHash
endp
So we can guess that it will perform hash...
Compute the hash of the created string : (H1,H2,H3,H4)
_text:00401C9E
lea edx, [esp+2Ch]
_text:00401CA2
lea eax, [esp+edi+3Ch]
_text:00401CA6
push edx
_text:00401CA7
push eax
_text:00401CA8
call Hash
Perform an AND on H1...
_text:00401CB7
mov ebx, [esp+2Ch]
_text:00401CBB
lea ecx, [esp+28h]
_text:00401CBF
lea edx, [esp+24h]
_text:00401CC3
push ecx
_text:00401CC4
lea eax, [esp+24h]
_text:00401CC8
push edx
_text:00401CC9
lea ecx, [esp+24h]
_text:00401CCD
push eax
_text:00401CCE
push ecx
_text:00401CCF
lea edx, [esp+434h]
_text:00401CD6
and ebx, 0FFFFh
We learn that serial have to be composed of 4 longs ( A,B,C and
D):
_text:00401CCF
lea edx, [esp+434h]
_text:00401CD6
and ebx, 0FFFFh
_text:00401CDC
push offset aLxLxLxLx
_text:00401CE1
push edx
_text:00401CE2
mov [esp+44h], ebx
_text:00401CE6
call _sscanf
_text:00401CEB
add esp, 18h
_text:00401CEE
cmp eax, 4
_text:00401CF1
jz FormatSerial
Then the 4 longs ( A,B,C, D) are used to compute 4 keys... (KeyA,KeyB,KeyC,KeyD)
_text:00401D11 FormatSerial:
_text:00401D11
xor esi, esi
_text:00401D13
lea edi, [esp+1Ch]
_text:00401D17
_text:00401D17 loc_0_401D17:
_text:00401D17
mov eax, 0BADC0DEh
_text:00401D1C
lea ecx, [esi+50h]
_text:00401D1F
cdq
_text:00401D20
idiv ecx
;( BADCODEh /(50h+esi)) times
_text:00401D22
push eax
_text:00401D23
push edi
_text:00401D24
call checkkey
_text:00401D29
add esp, 8
_text:00401D2C
inc esi
_text:00401D2D
add edi, 4
_text:00401D30
cmp esi, 3
_text:00401D33
jl short loc_0_401D17
_text:00401D35
xor eax, eax
_text:00401A25 LoopGenereKey:
_text:00401A25
mov ebp, edi
_text:00401A27
mov ecx, 1
_text:00401A2C
shr ebp, 1Fh
_text:00401A2F
mov [esp+10h+arg_4], ebp
_text:00401A33
mov eax, esi
_text:00401A35
mov edx, edi
_text:00401A37
xor ebp, ebp
_text:00401A39
call __allshl
_text:00401A3E
mov ecx, [esp+10h+arg_4]
_text:00401A42
or ebp, edx
_text:00401A44
or ecx, eax
_text:00401A46
xor edx, edx
_text:00401A48
mov esi, ecx
_text:00401A4A
mov ecx, 0Bh
_text:00401A4F
mov eax, esi
_text:00401A51
mov edi, ebp
_text:00401A53
and eax, 4
_text:00401A56
call __allshl
_text:00401A5B
mov ecx, esi
_text:00401A5D
xor ebp, ebp
_text:00401A5F
and ecx, 2000h
_text:00401A65
xor edx, ebp
_text:00401A67
xor eax, ecx
_text:00401A69
mov ecx, 12h
_text:00401A6E
call __allshl
_text:00401A73
mov ecx, esi
_text:00401A75
xor edx, ebp
_text:00401A77
and ecx, 80000000h
_text:00401A7D
xor eax, ecx
_text:00401A7F
mov ecx, 1
_text:00401A84
call __allshl
_text:00401A89
xor esi, eax
_text:00401A8B
xor edi, edx
_text:00401A8D
dec ebx
_text:00401A8E
jnz short LoopGenereKey
To make a keygen we have to understand how key are computed:
Put (A,B) in (esi,edi) and repeat ( BADCODEh /50h ) times :
- make (esi,edi) bits rotate (the two 32 bits registers are used as
one 64 bits register )
- replace the bit31 by (bit2 xor bit13 xor bit31 )
Result : (KeyA,Bt)
Put (Bt,C) in (esi,edi) and repeat ( BADCODEh /51h ) times :
- make (esi,edi) bits rotate (the two 32 bits registers are used as
one 64 bits register )
- replace the bit31 by (bit2 xor bit13 xor bit31 )
Result : (KeyB,Ct)
Put (Ct,D) in (esi,edi) and repeat ( BADCODEh /52h ) times :
- make (esi,edi) bits rotate (the two 32 bits registers are used as
one 64 bits register )
- replace the bit31 by (bit2 xor bit13 xor bit31 )
Result : (KeyC,KeyD)
Compare the 4 keys with the hashed string value: (H1,H2,H3,H4) == (KeyA,KeyB,KeyC,KeyD)
_text:00401D37 loc_0_401D37:
_text:00401D37
mov edx, [esp+eax+1Ch]
_text:00401D3B
mov ecx, [esp+eax+2Ch]
_text:00401D3F
cmp edx, ecx
_text:00401D41
jnz short BadBoy
_text:00401D43
add eax, 4
So to make a keygen we have to modify checkkey in order to find
( A,B,C,D) thanks to (H1,H2,H3,H4)...
We know that ((bit2 xor bit13 xor bit31 ) xor bit2 xor bit13) = bit31
So if checkkey replace the bit31 by (bit2 xor bit13 xor bit31 ) and
then make (esi,edi) bits rotate in reverse order,
we will find what you want.
| Name |
Amenesia |
| Serial |
7b16b9a9 e748747b c57f17a3 a5767edc |
|
|