|
file_id.diz:
TEAM TSRh 2003 date: 02-09-2003
██▀▀▀▀▀▀▀▀▀▀▀█ ▀▀▀▀▓ █▀▀▀▀▀▀▀▀█ █▀▀█ █▀▀▀█
▓█ █▀█ █▀█ █ ▄ ▀ █ █ █▀█ ░ █ █ █ █ ░ █
▒▓▄█ ▓ █ █▄▄▓ █ ▀▀▀ ▓ █▄█ ▄▄▓ ▓ █▄█cXc▓
▒█ █ ▄▄▄▄ ▀█▀▀█ ▒█ █ █▄▄▄▄ ▒█ █ █CPH█
/ ░███ █ █▄▄█ █ ░█ █ █ ▄ █ ░███ █ ▄ █
/ ▒███ █▓▄▄▄▄▄▄▓█ ▒█▄█ █▄▄▄█ ▒███ █▄▄▄█
Invisible Keylogger 1.3
tutorial.eng
invisible.keylogger.1.3.tutorial.eng-tsrh.txt:
Invisible Keylogger 1.3 keygenning tutorial..
. (specialy for Irc Mafia) .
tools:
HiEW
IDA
PE Explorer(1.93 better)
Pascal compiller(for keygen)
.. and brains 8) ..
target:
Invisible Keylogger 1.3
web: www.invisiblekeylogger.com
Well let's start.. First run prog.. We see some nag screen. Well
just push "Enter registration code..." button and we see
registration dialog.. Enter some name and registration
code...push ok button.. What we see? Yeah we see error message:
"Registration code or user name is invalid. Plese check..."
Load .exe in pexplorer and go to resource tab. Open strings dir
and find(Ctrl+F) there string what we saw in error message...
Look number of string..(57510) and convert it in hex format =
E0A6h.
Then may close pexplorer :).. and load .exe in IDA.. while it
disassembling we shall use HiEW to find where error message was
called. Open HiEW.. turn in assembler mode. Push F7 for find
window and F7 once again for assembler find window.. then enter
there "?push?E0A6" and push enter. We will be at 00416A
D8.
Ok we found what we wanted. Close HiEW and go in IDA.
We move to 00416AD8 and see:
-------------cut here-------------------------
00416A83 lea eax, [ebp-0CCh]
00416A89 push eax ;buffer where will be correct serial
00416A8A lea eax, [ebp-98h]
00416A90 push offset dword_4034C0;xorer by
tes
00416A95 push eax ;entered name
00416A96 call sub_4168A8 ;generate correct serial
00416A9B add esp, 0Ch
00416A9E lea eax, [ebp-64h]
00416AA1 push eax ;entered serial
00416AA2 lea eax, [ebp-0CCh]
00416AA8 push eax ;correct serial
00416AA9 call ds:lstrcmpiA ;compare right & enterd serial
00416AAF test eax, eax
00416AB1 push 0FFFFFFFFh
00416AB3 push 40h
00416AB5 jnz short loc_416AD8;if not equal jump to error
00416AB7 push 0E016h
00416ABC call ?AfxMessageBox@@YGHIII@Z
00416AC1 lea eax, [ebp-64h]
00416AC4 push eax
00416AC5 lea eax, [ebp-98h]
00416ACB push eax
00416ACC call sub_416975
00416AD1 pop ecx
00416AD2 pop ecx
00416AD3 push 1
00416AD5 pop eax
00416AD6 jmp short loc_416AEF
00416AD8 ; -------------------------------------
00416AD8
00416AD8 loc_416AD8:
00416AD8 push 0E0A6h ;error message
00416ADD call ?AfxMessageBox@@YGHIII@Z
00416AE2 push 12Ch
00416AE7 call ds:Sleep
00416AED
00416AED loc_416AED:
00416AED xor eax, eax
00416AEF
00416AEF loc_416AEF:
00416AEF pop edi
00416AF0 pop esi
00416AF1 leave
00416AF2 retn
-------------cut here-------------------------
If you want just correct serial..can look it in [ebp-0CCh] when
it's generated.. but we can write a keygen for it!
Look in sub_4168A8 to get keygen algo:
-------------cut here-------------------------
004168E3 cmp esi, ebx ;compare length of name & xorer
004168E5 mov [ebp+len], esi
004168E8 jg short loc_4168ED
004168EA mov [ebp+len], ebx
004168ED
004168ED loc_4168ED:
004168ED xor esi, esi
004168EF cmp [ebp+len], esi;if len = 0 then
004168F2 jle short loc_416920;exit
004168F4
004168F4 loc_4168F4:
004168F4 mov eax, esi
004168F6 push 19h
004168F8 cdq
004168F9 idiv [ebp+xorer_len]
004168FC mov eax, esi
004168FE pop ebx
004168FF lea ecx, [edx+edi]
00416902 cdq
00416903 idiv [ebp+name_len]
00416906 mov eax, [ebp+name]
00416909 movzx eax, byte ptr [edx+ea
x];in eax name
0041690D movzx edx, byte ptr [ecx];in ec
x xorer
00416910 xor eax, edx
00416912 cdq
00416913 idiv ebx
00416915 add dl, 41h; create char
00416918 inc esi
00416919 cmp esi, [ebp+len]
0041691C mov [ecx], dl
0041691E jl short loc_4168F4; loop
-------------cut here-------------------------
Now we know all what needed for a keygen! Try to port this code
to pascal. Here we need to use our brains :) or you can use asm.
Here is a function which generate a correct serial:
-------------cut here-------------------------
function keygen(name: pchar): pchar;
const
_xorer=#$5f+#$71+#$20+#$3c+#$40+#$36+#$3d+#$f2
+#$68+#$2f+#$31+#$37+#$67+#$d8+#$2c+#$3e+#0;
var
i,i2,i3 : integer;
name_len,xorer_len : integer;
xorer : pchar;
begin
xorer := allocmem(20);
lstrcpy(xorer,_xorer);
name_len := lstrlen(name);
xorer_len := lstrlen(xorer);
if name_len > xorer_len then i2 := name_len else i2 := xorer_len;
for i:=0 to i2-1 do begin
i3 := i mod xorer_len;
xorer[i3] := char((int(name[i mod name_len]) xor int(xorer[i3]))
mod $19 + $41);
end;
result := xorer;
end;
-------------cut here-------------------------
This function must work in FreePascal 6..
The END.
Writer: EGOiST[TSRh]
Web : ego1st.cjb.net
Date : 09.08.2003 16.50
|
