lena151's ReverseMe#2 by lena151

Some time ago, I coded a freeware application in which a registration scheme was only implemented to help me keep track of its use (free registration).
I amused myself coding a rather difficult scheme, however, it can easily be made many times harder.
To comply with forum rules, I have grabbed the registration scheme and made a CrackMe from it.
Everything is allowed : serialfishing, patching, brute forcing ... the ultimate goal being a keygen.
The only nag in the real stuff is when clicking the "Register" button as each time an action is required, the registration scheme is re-run internally to decide on acting or not. To make the reverseme easier, I have also implemented a startup and closing nag.
It's clear that killing the nags and About Box is NOT helping. This only confirms the non-registration internally.
In a valid solution, the goodboys are shown.
I built some useless code around the CrackMe to make it the normal size of the software.
ReverseMe is not packed nor encrypted. I believe it is virtually impossible without the following hints though :
1. For the application to be registered, it must say "REGISTERED" on the registration window. However, all the obvious goodboys in the strings (Success ... Registration SuccessFull ... Thanks for your support !!!! ... REGISTERED) are NOT used but are diversion code, seek elsewhere !
2. This "reverseme" is in fact part of an application which has 20 (twenty !) checks and doublechecks. If any of these fail, you are sent in the woods to go play with Robin Hood. In this case, the real serial is never calculated (only a fake diversion serial is calculated). BTW, assume anything by "checks and doublechecks", like suppose : verifying if the length of a certain part of the serial is right, else --> go see Robin in the woods.
3. This reverseme is part of a real application : at startup, it verifies for "was I previously registered or not ?". If it was registered before, the registration scheme is not shown in the real application. BTW, the reverseme shows the goodboy at startup when registered before (because there is no "application" here).
4. Find the ring0 debugger checks (find them all !) --> else go see Robin Hood
5. Find the ring3 debugger checks (find them all !) --> else go see Robin Hood
6. Find the anti-tracing --> else go see Robin Hood
7. ALL detecting is silent : if anything suspicious is detected --> go see Robin Hood
8. Expect some more tricks, probably these being the most important factor of faillure of all.

Success and have fun !
lena151

Difficulty: 7 - Very hard
Platform: Windows
Language: Unspecified/other

Published: 27. Jun, 2007
Downloads: 1077