downloadbrowsemucki's crackme#2

Download crackme2.zip, 31 kb (password: crackmes.de)
Browse contents of crackme2.zip

This is my second crackme (keygenme), now written in Assembler.

- find the solution
- make a keygen
- and submit a tutorial

tested on WinXP SP1 but should also work on other windows os.

Regards,

mucki

Difficulty: 1 - Very easy, for newbies
Platform: Windows
Language: Assembler

Published: 09. Oct, 2006
Downloads: 1813

Rating

Votes: 6
Crackme is nothing special.

Rate this crackme:

Send a message to mucki »

View profile of mucki »

Solutions

Solution by BaKaE, published 11. oct, 2006; download (243 kb), password: crackmes.de or browse.

BaKaE has rated this crackme as quite nice.

Solution by hardcoder, published 07. oct, 2006; download (4 kb), password: crackmes.de or browse.

hardcoder has rated this crackme as nothing special.

Solution by ghostz, published 07. oct, 2006; download (618 kb), password: crackmes.de or browse.

ghostz has not rated this crackme yet.

Solution by Kostya, published 07. oct, 2006; download (3 kb), password: crackmes.de or browse.

Kostya has rated this crackme as quite nice.

Solution by geeko, published 07. oct, 2006; download (206 kb), password: crackmes.de or browse.

geeko has not rated this crackme yet.

Solution by evo_it, published 07. oct, 2006; download (10 kb), password: crackmes.de or browse.

evo_it has rated this crackme as quite nice.

The submission of solutions is closed.

Discussion and comments

BaKaE
05. Oct 2006
nice, i've cracked your first one, now i try this one

>> what protection has it ??
kiTo
05. Oct 2006
PEiD says "EXECryptor 1.x.x -> SoftComplete Developement".

I haven't checked more about it.
EvOlUtIoN
05. Oct 2006
i htink peid commits a mistake, it isn't packed at all
mucki
Author
05. Oct 2006
you are right, i manipulated the pe-header ;)
badmojo
05. Oct 2006
Its not packed at all, just some simple antidebugging tricks and a simple serial algo, pretty good for newbies.

mucki, is the function at 401288 an extra challenge of some sort or just leftover code?

Thanks
mucki
Author
05. Oct 2006
i tried to make a md2 crackme, but there were only errors. i left the code because i was too lazy to remove it again. you can detect it with krypto analyzer (plugin of peid).
evo_it
05. Oct 2006
nice crackme it can get newbies learn some nice tricks
DaBookshah
06. Oct 2006
I liked the tactic of having irritating, repetitive music, so that when its paused the cracker has a chance of going nuts.
ghostz
06. Oct 2006
Nice Crackme ;)
I Try to submit a solution and keygen with source (Delphi 7)
Thx mucki :)
baudstupid
06. Oct 2006
In the interest of education can someone please explain to me how the debugger detector works??? It's only a few lines of assembler, with no conditions like JZ or anything? How does the prog decide to show the msgbox or not? Please educate me!
hardcoder
06. Oct 2006
I wonder what is the use of code beyond 00401288. KeyGen is too easy.I like
0040103C |. 9C PUSHFD
0040103D 813424 540100>XOR DWORD PTR SS:[ESP],154
00401044 |. 9D POPFD

nice but simple trick
DeepBlue
06. Oct 2006
I am single-stepping over a PUSH Command and the whole Program starts running. I was like ZOMG WTF!!!!1
Has to be some hideous SEH-Handler am I right? :)
DeepBlue
06. Oct 2006
Oh, now that I see the comment above mine its becomes clear to me. I am so blind ;) love that trick. <3
BaKaE
09. Oct 2006
your endless-loop trap in edx is nice
but
how did make it, how did the prog come to edx = 1 instead of edx = 0??
geeko
09. Oct 2006
we dont care of edx. patch in mem to 0 and go on debugging. Maybe is set in the fake SEH. good
BaKaE
09. Oct 2006
i know i know i wrote a tut maybe approved or not

mucki should be proud => so many solutions for his one
mucki
Author
09. Oct 2006
thx for the nice tutorials! it's solved now so i uploaded it again incl source. that's why it was off on sunday.
evo_it
09. Oct 2006
as i wrote in my solution edx is set using a code similar to the one that's in the IsDebuggerPresent API...
2HeLLboY
10. Oct 2006
bit hard for newbies like me
i made a crack but the keygen.....i couldn't
mucki
Author
10. Oct 2006
normally you have to write a keygen to solve a crackme and in my opinion the algo is rather easy.
hardcoder
10. Oct 2006
@2HeLLboY: you don't need to understand the algorithm at all. It's so easy that you can Rip it and use for you own need
BaKaE
10. Oct 2006
it is better to understand the algo, to learn more about asm
you can't learn from ripping this code
deskyet
23. May 2007
Your right BaKaE, i was trying to understand how SHR and SHL works in delphi, but I can't find a way how you can move the bits up to the left and right. Somebody know how to SHRL EAX,4 if EAX=0000006A, I know its 2 after Shifting, but How to calcutlate that..? PM me or answer here please, thank you.
deskyet
23. May 2007
nah, I already got it, but I still don't know how you can calculate it with the windows calculator bit shifting.

in delphi its for example:
var
EAX: integer;
begin
EAX:= $6A SHL 4;
showmessage(IntToStr(EAX));
mucki
Author
23. May 2007
bitshift to the left is the same like *2 and bitshift to the right is the same like /2 -> there is not much to calculate.
if you want to take windows calculator for bitshift enter your number and click "bin" to convert it into a binary number. then add a 0 behind the value and convert it back into decimal/hex.
razor7771911
15. Apr 2012
can any one help me i am n00b

You may leave your comment, thoughts and discuss this crackme with other reversers here.
Acting childish will not be tolerated.
HTML and such will be left as-is, so don't try.