| Target: | CyberClean 1.02 |
| Author: | The Limit Software |
| Protection: | Name/Serial |
| Tools used |
- lcc - SoftICE 3.2 |
| Level |
(X) Beginner (X) Intermediate ( ) Advanced ( ) Expert |
:00406713 66C745CC0800 MOV WORD PTR [EBP-34],0008 :00406719 33C0 XOR EAX,EAX :0040671B 8945FC MOV [EBP-04],EAX :0040671E 8D55FC LEA EDX,[EBP-04] :00406721 FF45D8 INC DWORD PTR [EBP-28] :00406724 8B86C8010000 MOV EAX,[ESI+000001C8] :0040672A E831B60000 CALL 00411D60 :0040672F 8B55FC MOV EDX,[EBP-04] :00406732 8D45FC LEA EAX,[EBP-04] :00406735 03D3 ADD EDX,EBX :00406737 4A DEC EDX :00406738 0FBE0A MOVSX ECX,BYTE PTR [EDX] :0040673B 83E17F AND ECX,7F :0040673E BA02000000 MOV EDX,00000002 :00406743 03F9 ADD EDI,ECX :00406745 FF4DD8 DEC DWORD PTR [EBP-28] :00406748 E89B110100 CALL 004178E8 :0040674D 43 INC EBX :0040674E 8B86C8010000 MOV EAX,[ESI+000001C8] :00406754 E8B7B50000 CALL 00411D10 :00406759 3BD8 CMP EBX,EAX :0040675B 7CB6 JL 00406713 :0040675D 69D76B280400 IMUL EDX,EDI,0004286B :00406763 89D7 MOV EDI,EDX :00406765 83FF01 CMP EDI,01 :00406768 7D05 JGE 0040676F :0040676A BFE4440000 MOV EDI,000044E4 :0040676F 66C745CC2000 MOV WORD PTR [EBP-34],0020 :00406775 33C0 XOR EAX,EAX :00406777 8945F8 MOV [EBP-08],EAX :0040677A 8D55F8 LEA EDX,[EBP-08] :0040677D FF45D8 INC DWORD PTR [EBP-28] :00406780 8B86D4010000 MOV EAX,[ESI+000001D4] :00406786 E8D5B50000 CALL 00411D60 :0040678B 837DF800 CMP DWORD PTR [EBP-08],00 :0040678F 7405 JZ 00406796 :00406791 8B5DF8 MOV EBX,[EBP-08] :00406794 EB05 JMP 0040679B :00406796 BBB4514400 MOV EBX,004451B4 :0040679B 53 PUSH EBX :0040679C E8DF4F0300 CALL 0043B780 :004067A1 59 POP ECX :004067A2 8BD8 MOV EBX,EAX :004067A4 FF4DD8 DEC DWORD PTR [EBP-28] :004067A7 8D45F8 LEA EAX,[EBP-08] :004067AA BA02000000 MOV EDX,00000002 :004067AF E834110100 CALL 004178E8 :004067B4 66C745CC1400 MOV WORD PTR [EBP-34],0014 :004067BA 8BCF MOV ECX,EDI :004067BC 8BC1 MOV EAX,ECX :004067BE 99 CDQ :004067BF 33C2 XOR EAX,EDX :004067C1 2BC2 SUB EAX,EDX :004067C3 3BD8 CMP EBX,EAX :004067C5 0F8537010000 JNZ 00406902Well the serial is calculated from all the chars - execpt the last one of your name. So if your name is for instance BORED then the ASCII values of 'BORE' multiplicated by 4286B is the real serial. If your name is however 1 char long (or less), then no char can be used for the calculation of your Reg No, so your Reg No would be 0 (something multiplicated by 0 is ALWAYS 0 - as you OF COURSE should know). This is the reason why the coder of this program has included the following three lines:
:00406765 83FF01 CMP EDI,01 :00406768 7D05 JGE 0040676F :0040676A BFE4440000 MOV EDI,000044E4These lines just check the CASE your name was 1 char or less long (BTW, I don't know any name which could be 1 char long). So there's something you have to take care of:
short int Calculate(HWND hDialog)
{
unsigned char name[1024] = {0};
unsigned char serial[1024] = {0};
unsigned long ECX = 0;
unsigned long EDX = 0;
unsigned long EDI = 0;
unsigned long i;
static HWND hControl;
hControl = GetDlgItem(hDialog, EDIT_NAME);
GetWindowText(hControl, &name, 1024);
if (strlen(name) <= 1)
EDI = 0x44E4;
else
{
for (i = 1; i <= (strlen(name) - 1); i++)
{
ECX = name[i-1];
EDI += ECX;
}
EDX = EDI * 0x4286B;
}
wsprintf(serial, "%lu", EDX);
hControl = GetDlgItem(hDialog, EDIT_CODE);
SetWindowText(hControl, serial);
return 0;
}
Feel free to e-mail me feedback, questions or whatever (NO crack requests!!). You can
also talk to me on IRC (EFNet) at
#ImmortalDescendants,
#PhrozenCrew or
#cracking4newbies.