"Yenilsen de yensen de, taraftarin seninle. Iyi gunde, kotu gunde, seninle birlikte."

Register bolumune “1907” degerini girelim. [bpx hmemcpy] -> [F12]

0167:00411305 CALL [USER32!GetDlgItemTextA]
0167:0041130B PUSH 00425660                         <- buradayiz, TESTFISH
0167:00411310 PUSH 00428E94                         <- 1907
0167:00411315 CALL [004200A0]

Programin, girdigimiz sallama serial degerine erismeye calistigi ani bulmaya calisalim. [bpm 428E94] -> 2.inci break’den sonra,

0167:00403156 MOV ECX,[00428E94]
0167:0040315C MOV [EBP-38],ECX                      <- buradayiz
0167:0040315F MOV DX,[00428E98]
...
0167:004031A4 CMP ECX,2D
0167:004031A7 JNZ 004031AB
0167:004031A9 JMP 00403173
0167:004031AB MOVSX EDX,BYTE PTR [EBP-24]
0167:004031AF CMP EDX,7A                           <- “z” ile kontrol
0167:004031B2 JG 004031BD
0167:004031B4 MOVSX EAX,BYTE PTR [EBP-24]          <- 31 30 39 37 -> 1 9 0 7
0167:004031B8 CMP EAX,41                           <- “A” ile kontrol
0167:004031BB JGE 004031C6
0167:004031BD MOV DWORD PTR [EBP-48],00000001      <- kotu cocuk
0167:004031C4 JMP 004031C8
0167:004031C6 JMP 00403173
0167:004031C8 CMP DWORD PTR [EBP-48],00
0167:004031CC JNZ 00403391                         <- kotu cocuk

Sallama serial “A” ile “z” arasindaki karakterlerden olusmuyorsa, 4031BD’de [ebp-48] bolgesine 1 degeri yaziliyor ve bunun sonucu olarak 4031CC’de JUMP yapiyor. Sonucta, girdigimiz “1907” degeri bir isleme girmiyor. Sallama degerimizi “amois” olarak degistirelim. Kucuk harfle yazsak da, program buyuk harfe donusturuyor. Bu da ayri bir ipucu zaten.

...
0167:00403173 MOV EAX,[EBP-40]                    <- sayac, baslangicta 0
0167:00403176 ADD EAX,01
0167:00403179 MOV [EBP-40],EAX
0167:0040317C CMP DWORD PTR [EBP-40],06           <- karakter sayi kontrol
0167:00403180 JGE 004031C8                        <- en az 6 olmali
...

Girdigimiz deger 403173 ile 4031C6 arasinda donguye giriyor. 40317C’ye gore, girmemiz gereken deger en az 6 karakter olmali. Aksi takdirde, program 4031C8’e gidemiyor ve sonucta eax degeri 0 olarak geri donuyor. Sallama serial “CRACKS” ->

0167:00403173 MOV EAX,[EBP-40]
0167:00403176 ADD EAX,01
0167:00403179 MOV [EBP-40],EAX
0167:0040317C CMP DWORD PTR [EBP-40],06
0167:00403180 JGE 004031C8
0167:00403182 MOV ECX,[EBP-40]
0167:00403185 MOV DL,[ECX+EBP-38]
0167:00403189 MOV [EBP-24],DL
0167:0040318C MOVSX EAX,BYTE PTR [EBP-24]         <- C R A C K S
0167:00403190 ADD EAX,[EBP-40]                    <- [ebp-40] -> sayac
0167:00403193 IMUL EAX,[EBP-44]                   <- [ebp-44] -> baslangicta 1
0167:00403197 MOV [EBP-44],EAX                    <- 43 15B9 5AF6B ...
...
0167:004031C6 JMP 00403173

Dongu sonucunda [ebp-44] bolgesinde 37429850 degeri olustu.

0167:004031D2 MOV ECX,[EBP-28]                    <- ecx=3
0167:004031D5 IMUL ECX,ECX,000000C8               <- ecx=258 oldu
0167:004031DB MOV EAX,[EBP-44]                    <- 37429850
0167:004031DE XOR EDX,EDX                         <- edx bolme icin sifirlandi
0167:004031E0 DIV ECX                             <- eax’i ecx’e bol
0167:004031E2 MOV [EBP-44],EAX                    <- eax=1793E1 oldu
0167:004031E5 CMP DWORD PTR [EBP-44],000F1B30     <- sabit sayi ile kontrol
0167:004031EC JBE 004031F8                        <-
0167:004031EE MOV EDX,[EBP-44]                    <- edx=1793E1
0167:004031F1 SHR EDX,1                           <- edx=BC9F0 oldu, 2'ye bolundu
0167:004031F3 MOV [EBP-44],EDX
0167:004031F6 JMP 004031E5
0167:004031F8 CMP DWORD PTR [EBP-44],000186A0     <- sabit sayi ile kontrol
0167:004031FF JAE 0040320B                        <-
0167:00403201 MOV EAX,[EBP-44]                    <-
0167:00403204 SHL EAX,1                           <- 2 ile carp
0167:00403206 MOV [EBP-44],EAX                    <-
0167:00403209 JMP 004031F8
0167:0040320B MOV ECX,[EBP-44]                    <- ecx=BC9F0
0167:0040320E ADD ECX,00000080                    <- 80h ekle
0167:00403214 MOV [EBP-44],ECX                    <- ecx=BCA70 oldu
0167:00403217 MOV EDX,[EBP-44]                    <- edx=BCA70
0167:0040321A PUSH EDX
0167:0040321B PUSH 004251F8                       <- %d
0167:00403220 LEA EAX,[EBP-32]
0167:00403223 PUSH EAX
0167:00403224 CALL 004150DC                       <- decimal’e cevir

4031E5 ve 4031F8’deki sabit sayilar, cikan sonucu belli bir aralikta tutmak icin kullaniyor. F1B30h=990000 ve 186A0h=100000, yani islem sonucu cikacak sayi, bu iki degerin arasinda kalacak.

Butun bu islemlerden sonra BCA70h degerimiz decimal’e cevrilip “CRACKS” ile birlestirilerek “CRACKS772720” oldu. Bundan sonra ufak bir trick daha var.

0167:0040322C MOV CL,[EBP-32]                     <- CL=”7”, ilk basamak
0167:0040322F MOV [EBP-24],CL                     <- bu degeri sakla
0167:00403232 MOV DL,[EBP-2D]                     <- DL=”0”, son basamak
0167:00403235 MOV [EBP-32],DL                     <- ilk basamak 0 oldu
0167:00403238 MOV AL,[EBP-24]                     <- AL=”7”
0167:0040323B MOV [EBP-2D],AL                     <- son basamak 7 oldu
0167:0040323E MOVSX ECX,BYTE PTR [EBP-32]         <- ecx=0
0167:00403242 CMP ECX,30                          <- ilk basamak 0 mi ?
0167:00403245 JNZ 0040324B
0167:00403247 MOV BYTE PTR [EBP-32],39            <- ilk basamagi 9 yap

Bu bolumde, cikan sonucun ilk ve son basamaklari bir isleme giriyor.

Son olarak bir detay daha kaldi. Program, yukarida acikladigim bolumlere toplam 2 kez ugruyor. Bu nedenle 2 ayri gecerli serial olusuyor. Aralarindaki tek fark, 4031D2’de ecx’e atanan degerler. 1.inci turda 3, 2.inci turda 7 degeri ataniyor. Buna gore carpim sonucu ecx’deki degerler 258h veya 578h oluyor.

.data

isim         db "CRACKS",0                         ; gecerli serialin sallama kismi
cop          dd 01h                                ; programdan
serial_1     db 10h dup(?)                         ; birinci serial icin
serial_2     db 10h dup(?)                         ; ikinci serial icin
sonuc_1      db 10h dup(?)                         ; birinci sonuc icin
sonuc_2      db 10h dup(?)                         ; ikinci sonuc icin
tur          db "%d",0                             ; decimal sonuc
sayac        dd 0h                                 ; adindan belli zaten

.code

start:

call @bolum_1                                     ; cop=37429850 oldu
mov ecx, 0258h                                    ; ilk tur icin sabit sayi
call @bolum_2                                     ; ecx=BCA70 oldu

invoke wsprintf, addr serial_1, addr tur, ecx     ; decimal olarak yaz
invoke szCatStr, addr sonuc_1, addr isim          ; isim ile serial_1 birlesecekler
invoke szCatStr, addr sonuc_1, addr serial_1      ; artik birlestiler

lea esi, sonuc_1                                  ; ilk gecerli serial icin hazirlan
call @bolum_3                                     ; ilk gecerli serial sonuc_1’de

mov sayac, 0                                      ; ikinci gecerli serial hazirliklari
mov cop, 1                                        ; cop degerimiz baslangicta 1 olmali
call @bolum_1                                     ;
mov ecx, 0578h                                    ; ecx bu sefer farkli sabit sayi
call @bolum_2

invoke wsprintf, addr serial_2, addr tur, ecx     ;
invoke szCatStr, addr sonuc_2, addr isim          ;
invoke szCatStr, addr sonuc_2, addr serial_2      ;

lea esi, sonuc_2                                  ;
call @bolum_3                                     ; ikinci gecerli serial sonuc_2’de

@cikis:
invoke ExitProcess, 0

@bolum_1:
lea esi, isim
add esi, sayac
movsx eax, byte ptr [esi]
add eax, sayac
imul eax, cop
mov cop, eax
inc sayac
cmp sayac, 06h
jl @bolum_1
ret

@bolum_2:
mov eax, cop
xor edx, edx
div ecx
mov cop, eax
@004031E5:
cmp cop, 0F1B30h
jbe @004031F8
mov edx, cop
shr edx, 1
mov cop, edx
jmp @004031E5
@004031F8:
cmp dword ptr cop, 0186A0h
jae @0040320B
mov eax, cop
shl eax, 1
mov cop, eax
jmp @004031F8
@0040320B:
mov ecx, cop
add ecx, 080h
ret

@bolum_3:
mov cl, byte ptr [esi+6]
mov dl, byte ptr [esi+0Bh]
mov byte ptr [esi+6], dl
mov byte ptr [esi+0Bh], cl
movsx ecx, byte ptr [esi+6]
cmp ecx, 30h
jnz @0040324B
mov byte ptr [esi+6], 039h
@0040324B:
ret

end start
 

Bir programı kullanarak para kazanıyorsanız, programı satın alın.