Author Acid_Cool_178
Target 2Sweet Crackme 2.B
Download it from http://2Sweet.tsx.orx 
Public Release  21 March 2001
Author Contact acid_cool_178@hotmail.com
Dedication Goes to 2Sweet and DaFixer for DeDe
Difficulty Level (1..7) 2 (EASY)
Tools Required DeDe (I'm are using version 2.50)
Download it from http://www.protools.cjb.net 

 

Introduction
 

I'm active these days, I love it.. Another lame keygenning tut be my.. enjoy it
 

Tutorial
 

Open the crackme in DeDe and you will after some while find this... I'm tired of telling this every time over and over again.. User you brain and try to find this source

***** TRY
|
0044229C   64FF30                 push    dword ptr fs:[eax]
0044229F   648920                 mov     fs:[eax], esp
004422A2   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TForm1.Edit1 : TEdit<-- Focus on the first number
|
004422A5   8B83C4020000           mov     eax, [ebx+$02C4]

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets the first number
|
004422AB   E8B40FFEFF             call    00423264 <-- Executes the function
004422B0   8B45FC                 mov     eax, [ebp-$04] <-- EAX == N1 (N1 == Number1)

* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer;<-- Converting ASCII to HEX
|
004422B3   E8B853FCFF             call    00407670 <-- Executes the function
004422B8   8BF0                   mov     esi, eax <-- ESI == N1 in HEX
004422BA   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TForm1.Edit2 : TEdit <-- Focus on the N2 (Number 2)
|
004422BD   8B83C8020000           mov     eax, [ebx+$02C8]

* Reference to: controls.TControl.GetText(TControl):System.String; <-- Gets N2
|
004422C3   E89C0FFEFF             call    00423264 <-- Executes the function
004422C8   8B45FC                 mov     eax, [ebp-$04] <-- EAX == N2

* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer;<-- Converts ASCII N2 to HEX
|
004422CB   E8A053FCFF             call    00407670<-- Executes the function
004422D0   8BF8                   mov     edi, eax<-- EDI == N2 in HEX
004422D2   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TForm1.Edit3 : TEdit <-- Focus on the CheckNumber
|
004422D5   8B83CC020000           mov     eax, [ebx+$02CC]

* Reference to: controls.TControl.GetText(TControl):System.String;<-- Gets the CheckNumber
|
004422DB   E8840FFEFF             call    00423264<-- Executes the function
004422E0   8B45FC                 mov     eax, [ebp-$04] <-- EAX == ASCII CheckNumber

* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer;<-- Converts the ASCII CheckNumber to HEX
|
004422E3   E88853FCFF             call    00407670 <-- Executes the function
004422E8   8BD8                   mov     ebx, eax <-- EBX == CheckNumber in HEX
004422EA   8D0C37                 lea     ecx, [edi+esi] <-- ECX == N2+N1
004422ED   8D047F                 lea     eax, [edi+edi*2] <-- EAX == N2+N2*2
004422F0   03C8                   add     ecx, eax <-- ECX == ECX + EAX
004422F2   8BC6                   mov     eax, esi <-- EAX == ESI
004422F4   03C0                   add     eax, eax <-- EAX == EAX + EAX
004422F6   2BC8                   sub     ecx, eax <-- ECX == ECX - EAX
004422F8   81C1F60D0000           add     ecx, $00000DF6 <-- ECX == ECX + DF6
004422FE   8BC1                   mov     eax, ecx <-- EAX == ECX
00442300   33D2                   xor     edx, edx <-- EDX == 0
00442302   F7F6                   div     esi <-- ECX / N1
00442304   8BC8                   mov     ecx, eax <-- EAX == ECX
00442306   3BD9                   cmp     ebx, ecx <-- Compare
00442308   750C                   jnz     00442316<-- Jump if not correct

* Possible String Reference to: 'OK'<-- The good message
|
0044230A   B878234400             mov     eax, $00442378 <-- EAX == Good Message

* Reference to: dialogs.ShowMessage(System.AnsiString); <-- Shows the good message
|
0044230F   E830F9FFFF             call    00441C44 <-- Executes the function
00442314   EB0A                   jmp     00442320 <-- jump to the end of this routine

* Possible String Reference to: 'INCORRECT' <-- The bad message
|
00442316   B884234400             mov     eax, $00442384 <-- EAX == Bad message

* Reference to: dialogs.ShowMessage(System.AnsiString); <-- Shows the bad message
|
0044231B   E824F9FFFF             call    00441C44 <-- Executed the function

 

 

EXAMPLE

N1 == 1234 == 4D2 hex
N2 == 56789 == 162E hex
CheckNumber == 2951 == B87 hex

Line1 == 4D2 + 162E == 1B00
Line2 == 162E + 162E * 2 == 428A
Line3 == 1B00 + 428A == 5D8A
Line4 == 4D2 + 4D2 == 9A4
Line5 == 5D8A - 9A4 == 53E6
Line6 == 53E6 + DF6 == 61DC
Line7 == 61Dc / 4D2 == 14 == 20 in Decimal

It took only 7 lines to calculate the serial in short mode, let's take it into one formula...

Variant1 == N1 + N2
Variant2 == N2 + N2 * 2
Variant3 == Variant1 + Variant 2
Variant4 == N1 + N1
Variant5 == Variant3 - Variant 4
Variant6 == Variant 5 + DF6
Variant7 == Variant7 / N1

Serial Variant7 in DECIMAL !!!!

 


Code in Corrier New... size 2
 
Final Thoughts
 

Fuck a rock and GOODNIGHT !!!!


 
Greetings to...


Special Greetings: 
LaZARuS for he's great tutorials....
+DaFixer for DeDe
The Cracking Answer for not even bugging me for writing or cracking anything, that group roxx!!!! You will get alotta work from me now soon :D

Groups:  HF, ID, TCA, GC, TMG

Individuals, ManKind, Dark Wolf, BiSHoP, Mercution, AlX, Falcon, Marton, Borna Janes, Analyst, Eternal Bliss, NARRoW, Subzonic, DiABLO, Eddie Van Camper, CD_Knight and all the rest that i have forgotten
 

The end.
Any mistakes, corrections, or comments may be mailed to the members individually, or to the group : hellforge@hellforge.org.