Essay #41: How to produce KeyGENs

How to produce KeyGENs
A general approach to the goal

Target:	Zip Manager 5.3
Author:	Software Excellence By Design
Protection:	Name/Serial
Tools used	- lcc - SoftICE 3.2
Level	`(X) Beginner (X) Intermediate ( ) Advanced ( ) Expert`

Disclaimer

Do I really have to remind you all that by BUYING and NOT stealing the software you use will ensure that these software houses will continue to produce even *better* software for us to use and more importantly, to continue offering even more challenges to breaking their often weak protection systems. BTW, It's illegal to use cracked Software!

If you're looking for cracks or serial numbers from these pages then your wasting your time, try to search elsewhere on the Web under Warez, Cracks, etc.

As a matter of fact there is growing interest in essays dealing HOW TO KEYGEN a target ... writing such essays requires a lot of time and extra work. Now holidays have started and I decided to write this essay, which shows in detail HOW TO PRODUCE KEYGENS.

The appropoach I've chosen here should work on quite a lot of target's and is so kinda GENERIC APPROPOACH to the goal of coding a KeyGEN for a target ...

To understand this essay and the KeyGEN coding process you need at least a basic knowledge of ASM. For that matter an excellent document has been written by CoRN2: Assembly for Crackers.

Step 1: How to start?
Of course, first of all you need to execute your target and find the Registration Screen. After that little work, you can start with the real process. So enter your Registration Details and enter SoftICE. Now set a BPX HMEMCPY, leave SoftICE and press the 'OK' button in the Registration Dialog. Now SoftICE should pop up. BD (disable) your BPX and start the tracing ... here is where all the fun starts :)

Step 2: The fun starts
For me the real fun is tracing through the target's code and find the instructions that are used for generating serials (or parts of them) or whatsoever of your Registration Details. This can be done (often) easier using a disassembler (hope you have a fast CPU) ... if you know what you are looking for :)

Back to the tutorial: Things generated must be checked ... either NOW or on start of the target. Very often the things are checked NOW; that eases your work (often) a lot. But what's next? Well your Registration Details have to be manipulated in some way so a number or whatsoever is generated out from them ... all this is done using ASM instructions.

A KeyGEN routine or whatsoever is CALLed (often) right before the real check if the enterd data is either correct or not; so the CALLs before the real check are quite interesting ... you don't need however to trace them all ... just find out by observing registers, ... what CALL you need to trace and what NOT. It's easy :)

Step 3: Starting to work on the algo
After having successfully found the algorithmus what does the manipulation used to generate the correct Registration Data, you have to work out how this works (of course). Here is where you need your basic ASM knowledge. Watch out for instructions like ADD, AND, ...

I highly suggest making notes on a piece of paper how this routine works and after that, use your favourite coding language to code a routine that does EXACTLY the same ... mostly it's just a simple algo ... but there are examples where the algo is really complex and a KeyGEN takes a lot of time. Working out a KeyGEN in such cases might however help you to improve your knowledge on KeyGEN coding :)

Step 4: What do I have to take care of?
Well this is just an addendum to the last step, however I suggest you to really find out if special chars are allowed in the Registration Data and what the minimal length of your name needs to be. Also be sure to check if spaces are allowed.

Step 5: Using the described technique
Now it's time for some real work with the technique I (tried) to explain in the above steps. If you haven't understand them all, there is now another chance you do so :)

As a target I've chosen an in my opinioun EASY target. I could've chosen a DIFFICULT target, but that's not really needed here, because if you want to KeyGEN DIFFICULT things you FIRST need the basic technique to work perfectly. That's the key to success! Enough theory now; let's use the technique.

I do assume you have the basic knowledge of cracking and a little experience so that you can actually find the compare between the real serial and the wrong one. If you don't have that experience you should read some more tutorials and then come back to this one. This is definately not a tutorial for a complete beginner to cracking, although lots of beginners might (hopefully) understand :)

After having enterd your Registration Details and after tracing a little bit throught the code you'll come accross the code, which calculates your serial (CALL, JNZ is always very suspicious):
:0045D7BD C745F800000000 MOV DWORD PTR [EBP-08],00000000 :0045D7C4 C745F400000000 MOV DWORD PTR [EBP-0C],00000000 :0045D7CB C745F000000000 MOV DWORD PTR [EBP-10],00000000 :0045D7D2 C745EC00000000 MOV DWORD PTR [EBP-14],00000000 :0045D7D9 C745E800000000 MOV DWORD PTR [EBP-18],00000000 :0045D7E0 C745E438270000 MOV DWORD PTR [EBP-1C],00002738 :0045D7E7 8B4508 MOV EAX,[EBP+08] :0045D7EA 8945FC MOV [EBP-04],EAX :0045D7ED 66C745D80000 MOV WORD PTR [EBP-28],0000 :0045D7F3 E904000000 JMP 0045D7FC :0045D7F8 66FF45D8 INC WORD PTR [EBP-28] :0045D7FC 0FBF45D8 MOVSX EAX,WORD PTR [EBP-28] :0045D800 83F82B CMP EAX,2B :0045D803 0F8D5B000000 JGE 0045D864 :0045D809 0FBF45D8 MOVSX EAX,WORD PTR [EBP-28] :0045D80D 8B4DFC MOV ECX,[EBP-04] :0045D810 0FBE0408 MOVSX EAX,BYTE PTR [ECX+EAX] :0045D814 8945E0 MOV [EBP-20],EAX :0045D817 8B45E0 MOV EAX,[EBP-20] :0045D81A 69C049870100 IMUL EAX,EAX,00018749 :0045D820 0145F8 ADD [EBP-08],EAX :0045D823 8B45E0 MOV EAX,[EBP-20] :0045D826 69C061870100 IMUL EAX,EAX,00018761 :0045D82C 0145F4 ADD [EBP-0C],EAX :0045D82F 8B45E0 MOV EAX,[EBP-20] :0045D832 69C095860100 IMUL EAX,EAX,00018695 :0045D838 0145F0 ADD [EBP-10],EAX :0045D83B 8B45E0 MOV EAX,[EBP-20] :0045D83E 69C037870100 IMUL EAX,EAX,00018737 :0045D844 0145EC ADD [EBP-14],EAX :0045D847 8B45E0 MOV EAX,[EBP-20] :0045D84A 69C057870100 IMUL EAX,EAX,00018757 :0045D850 0145E8 ADD [EBP-18],EAX :0045D853 8B45E0 MOV EAX,[EBP-20] :0045D856 69C0D9860100 IMUL EAX,EAX,000186D9 :0045D85C 0145E4 ADD [EBP-1C],EAX :0045D85F E994FFFFFF JMP 0045D7F8 :0045D864 8B45F0 MOV EAX,[EBP-10] :0045D867 0345F4 ADD EAX,[EBP-0C] :0045D86A 0345F8 ADD EAX,[EBP-08] :0045D86D 0345E4 ADD EAX,[EBP-1C] :0045D870 0345E8 ADD EAX,[EBP-18] :0045D873 0345EC ADD EAX,[EBP-14] :0045D876 B93DBB0D00 MOV ECX,000DBB3D :0045D87B 99 CDQ :0045D87C F7F9 IDIV ECX :0045D87E 8D4201 LEA EAX,[EDX+01] :0045D881 8945DC MOV [EBP-24],EAX :0045D884 8B450C MOV EAX,[EBP+0C] :0045D887 3945DC CMP [EBP-24],EAX :0045D88A 0F850F000000 JNZ 0045D89F :0045D890 B801000000 MOV EAX,00000001 :0045D895 E90C000000 JMP 0045D8A6 Now you have to understand the calculation instructions ... that's mostly quite easy once you found them all. Try to work out how the serial is generated yourself and then read on ...

So you know how it's generated, right? Well for a maximum of 2B h times (0045D800), a char of your name is read out and
- multiplicated by 18749 h and added to [EBP-08] (0045D81A and 0045D823) - multiplicated by 18761 h and added to [EBP-0C] (0045D826 and 0045D82C) - multiplicated by 18695 h and added to [EBP-10] (0045D832 and 0045D838) - multiplicated by 18737 h and added to [EBP-14] (0045D83E and 0045D844) - multiplicated by 18757 h and added to [EBP-18] (0045D84A and 0045D850) - multiplicated by 186D9 h and added to [EBP-1C] (0045D856 and 0045D85C) If your name is not 2B h chars long, then the rest of the chars will be just ignored.

After that multiplication thing, [EBP-08], [EBP-0C], [EBP-10], [EBP-14], [EBP-18] and [EBP-1C] were added together (0045D867 up to 0045D873) and then divided by (0045D876 and 0045D87C) DBB3D h. Finally the remainder of that division is increased by 1 (0045D87E) - and that's the real serial then. It's that easy :)

I don't see an interest in the whole KeyGEN source, so I've just added that calculation part to this tutorial:
short int Calculate(HWND hDialog) { unsigned char name[50] = {0}; unsigned char serial[100] = {0}; unsigned long EAX = 0; unsigned long TMP = 0; unsigned long EBP_10 = 0; unsigned long EBP_0C = 0; unsigned long EBP_08 = 0; unsigned long EBP_1C = 0x2738; unsigned long EBP_18 = 0; unsigned long EBP_14 = 0; unsigned long i = 0; static HWND hControl; hControl = GetDlgItem(hDialog, EDIT_NAME); GetWindowText(hControl, &name, 43); for (i = 1; i <= 0x2B; i++) { if (i <= strlen(name)) { EAX = name[i-1]; EBP_08 += (EAX * 0x18749); EBP_0C += (EAX * 0x18761); EBP_10 += (EAX * 0x18695); EBP_14 += (EAX * 0x18737); EBP_18 += (EAX * 0x18757); EBP_1C += (EAX * 0x186D9); } } EAX = EBP_10 + EBP_0C + EBP_08 + EBP_1C + EBP_18 + EBP_14; TMP = EAX / 0xDBB3D; EAX = EAX - (TMP * 0xDBB3D); EAX += 1; wsprintf(serial, "%lu", EAX); hControl = GetDlgItem(hDialog, EDIT_CODE); SetWindowText(hControl, serial); return 0; } Feel free to e-mail me feedback, questions or whatever (NO crack requests!!). You can also talk to me on IRC (EFNet) at #ImmortalDescendants, #PhrozenCrew or #cracking4newbies.

Another lesson has just finished. Hopefully you have learned something useful from it! Feel free contacting me anytime ... till next time, I highly recommend you to visit (or better download completely) +Fravia's excellent site, which has unfortunately been frozen!

Greetings (no specific order):

+Aesculapius, +Fravia, +MaLaTTiA, +ORC, +wAj, ^TheDevil, /Miz, ACiD BuRN, adenozin, alpine, AntiMaterie, AppBusta, Artex, Black Check, BJanes, ByteBurn, cALiGo, CoRN2, Carpathia, CrackZ, Crashtest, Cruehead, Da GRiM ReaPeR, DEATH, DEZM, DnNuke, douby, duelist, Eternal Bliss, FireWorx, G-RoM, HarvestR, Icecream, Iczelion, Jeff, josephCo, Kaparo, knotty, Kwai_Lo, LagPRO, LaZaRuS, Lord Soth, Lucifer48, MisterE, MiZ, McCodEMaN, Mr. NOP, Mr. WhiTe (WKT), NeuRaL NoiSE, nIabI, NiKai, Nitrus, Noos, Northpole, pain, Pedro, PeeGee, PeeWee, ^PlAyEr^, Predator NLS, Prof. X, Quantico, r4lph, R!SC, Rhytm, rudeboy, Santa Clawz, Scribe, SiONiDE, Steinowitz, TaG^, TaMaMBoLo, The +Sandman, The AntiXryst, The OWL, Thesmurf, Tin, tKC, viny, VisionZ, Vladimir, Volatility, yAtEs, yosh, ytc, WarezPup, WhizKiD, widYa@cL 2011.