Awaz Apni

I've read Bluetouff article  here . From that point, I decided to take a rapid look at how is that possible? Be careful, this must be considered as a MALWARE! For starters, the installer is packed with UPX but it doesn't need any serial for the installation to take place. The serial is only there to activate the software. After installing the software, you get a bunch of executables : - cdtsvc.exe : service of download control - cdtsvc64.exe : same as cdtsvc.exe but for 64 bits - cdtupd.exe : probably the executable for checking updates It seems that none of the executables are packed or whatsoever. Just analyzing cdtsvc.exe, I got quite a bunch of informations on the executable itself. Looking at C string references and unicode strings, you get to have those informations : Path : C:\\Documents and Settings\\jbroutin\\Mes documents\\Visual Studio 2008\\Projects\\ddp-hadopi\\hadopi-client-gui\\trunk\\Release\\cdtsvc.pdb RSA Key : BgIAAACkAABSU0ExAAQAAAEAAQCzLXpRE/3Y3n9F1lf2wlRsQ...

Today, I ate some little keygenme, quite interesting in fact for how it was conceived. First of all, since it's level 2 : - no packer - no obfuscator - no protections but serial checking It was pretty straightforward to find the serial checking routine. It's located in DialogFunc(). From there, we just need to identify username and serial fields using manual boron tagging. After that, stumble upon an interesting routine : .text:004010FB serial_check_wrapper proc near ; CODE XREF: DialogFunc+93 .text:004010FB call serial_check .text:00401100 retn .text:00401100 serial_check_wrapper endp As we can see, it's wrapping a call to some routine, which is in fact the serial checking routine. Why is this wrapped? We'll see that later ;) . Anyway, the serial checking routine is as followed : .text:00401200 serial_check proc near ; CODE XREF: serial_check_wrapper .text:00401200 push offset username .tex...

It's been some time since I updated my blog but today I got bored and reversed a very little crackme. It is the BratAlarm " Just a little crackme " that I'm going to talk about. It was a bit interesting in the sense that you need to have basic mathematics knowledge. Basic maths knowledge Complex numbers are used throughout the whole keygenme to generate the serial. Complex number basic operations used are the following : multiplication : (a, b) * (c, d) = (a*c - b*d, b*c + a*d) = (a + i*b) * (c + i*d) addition : (a, b) + (c, d) = (a + c, b + d) = (a + i*b) + (c + i*d) Where is the serial checking and generation located? First of all, this keygenme wasn't packed nor obfuscated in any sort so it was pretty simple to find out where the interesting parts are : - API analysis : DialogBoxParamA - Strings Using these twos clues, we can extract the fact that everything happens in DialogFunc() and that it is using complex numbers. How is the serial generated then? First we...