Brutim crackme # 03 from korsader

Introduction

I have no experience in reverse, there is some basic knowledge of the assembler that allows you to make a bithak of conditional jumps so that this application always goes to the success-path regardless of the entered value. But since it is too banal to be published here, and until the reproduction of the algorithm for checking the entered key is complete, I have not grown enough, I decided to try the brutus method, i.e. consistent selection of keys. Of course, I can not say that this method is distinguished by its steepness, but at least a detailed description of this method is not so often found among the articles on the reverse.

A source

Link to the original crackme # 03 .



In the thread where this crack is published, the user ARCHANGEL published the Brutus method in C ++, which really gives the correct password for this crack. He could afford to write brut in a high level language, since he was able to reproduce the algorithm and found the value 0x23a06032, with which the crc obtained is compared.

')

I have not yet learned how to analyze algorithms so deeply on asm, so I will work without departing from the cash register, using the check algorithm in the cracks itself as a black box.

Conditional Transition Analysis

We launch the quacks and turn off the sound on the computer (apparently, this is what the author was trying to achieve by adding sound).





I run OllyDbg 2.01 with the OllyExt plugin, in which the settings below are set:





This plugin will help get rid of some of the potential anti-debugging techniques.



Attach from Olga to the running process crackme # 03.exe: File → Attach ...





Next, we try to enter any value in the input field and easily find the code in which it is processed. You can do this by setting breakpoint on potential text retrieval functions (in particular, GetDlgItemTextA) or scrolling through the code of the source module - the benefit here is small. Click the Check button.





It works breakpoint, press F8 once and look at the listing. We see that the string we entered is stored at 004095BC . Also look at the instructions at 0040101F . It compares the length of the entered string with the value 12 and in case of inequality throws us at 004010AF .



Next, pay attention to the instruction at address 00401028 , which compares the 12th byte of the entered value with a value of 72, which is the letter r in ASCII-encoding. In case of inequality, again throws us on 004010AF . What kind of address is this? More on this later.



Now pay attention to the instructions in the range 00401031 - 0040104C . Having smoked the directory of the assembler commands with the repne and scas commands, as well as tracing the selected code area, we conclude that aehnprwy is a valid alphabet of the required key.







Now let's see what we have at 004010AF . There is a message about a failed password.







So let's summarize the primary analysis:



1) The key must consist of 12 characters;

2) The last character of the key must be r;

3) Key symbols must belong to the alphabet aehnprwy.

Brutfors

We proceed to the implementation of the brute method. We implement it first at the conceptual level. It is possible on the flowchart, it is possible in high level language. I implemented its prototype in C ++. To understand further material, it is necessary to digest the code under the spoiler.





Main steps:



1) Initialization of the key (password) initial value.

2) Key verification.

3) If the key is incorrect, then generate the next key and go to step 2. If the key is correct, go to step 4. If we have sifted through all the keys and none of them came up, go to step 5.

4) Crackme hacked.

5) Crackme is not hacked. Somewhere we were wrong.

Key initialization

The program stores and accesses the key at 004095BC - there we will initialize it. The alphabet is located at 00409071 .



004095CC is the memory address where we will store our CodeArray array.



To initialize the key, we find the unused area of ​​the code section and insert our instructions there. I chose the address 00404122 .



To actually complete this initialization, go to the place where GetDlgItemTextA is called, carefully replace its call with an unconditional transition to our code at 00404122 , and replace the preceding push commands with nop-s. We do everything carefully so that the address of the CMP EAX, 0C command remains the same: 0040101F .







The figure below shows the initialization code itself. At its end, we proceed to the key validation algorithm as a result of the unconditional transition to 0040101F .

Getting the next key value

Now we need to implement the code to get the next key value. We select the address 00404165 for this (immediately after the initialization code) and make the transition to it from the place where the program calls us lamers.



We modify the instructions for the addresses 004010AF and 004010B1 .







Well, at the address 00404165 we implement the code for obtaining a new key.

Launch

Click the Check button and go to drink tea. Damn, and the tea is already boiled long ago, will have to boil again.





After some time, we get:





Look what we have at 004095BC







happynewyear is the desired key.