haiklr — babylon_keygenme

Introduction

Language: C/C++

Platform: Windows

Arch: x86

Crackmes.one: https://crackmes.one/crackme/5ab77f5533c5d40ad448c260

Debugging/Reversing

Ok so today, I will check another small crackMe which is written in French.

First of all, lets check the string of the file by right clicking disassembler > search for > current module > string references.

Then of course we will click “[x] serial:” and will leave breakpoint there. (Btw, as we can see, it has rule for name whose length should be between 3 and 15 digit)

After reading name and serial, it does check and moves to keygen part.

This block right here, puts space between characters in the name (reverse to r e v e r s e ):

The string below is used for some calculation.

As this block iterates through above string and inc by one

and string becomes this

and in this block, each char from above string and each char from last form of our name “r e v e…” pushed for XOR calculation.

the string becomes this

And then this block reverse orders the string

Now string is

This blocks reads the string in two ways: first it gets one char from normal order and then it gets another char from end of string as

“1” is from left side, then it takes “\” which is from right side of the string.

Now string looks like this:

And this block checks all chars of the latest form of the string, for example char should be in 0x1F and 0x7A in ascii table if the character is bigger or lower then this then it must be replaced with number six (6).

Now string looks like this:

and boom!

And yeah if we wanna bypass all checks we can patch couple places, as it is shown below :)

Conclusion

Thanks to write, I like it, as it shows different programming algorithm in different function which basically helps us for see assembly looking of programming algorithm for example reverse the string etc.

REv3rs3Th3P14n3t