390 lines
16 KiB
Plaintext
390 lines
16 KiB
Plaintext
|
Welcome to XLogic's Assembly KeyGen tutorial.
|
||
|
|
|
||
|
|
What you will need:
|
||
|
|
TASM 3.0 or higher (Comes with TD).
|
||
|
|
A Good Text Editor (EDIT.COM).
|
||
|
|
A Good Dos Debugger (I will use TD, S-ICE and DG are also Acceptable).
|
||
|
|
A File access monitor (SCANF is included).
|
||
|
|
An ASM Command Listing (go buy a book).
|
||
|
|
A GOOD (intermediate) knowledge of ASM. <-- Don't bug me for help.
|
||
|
|
X-Tract 1.51 (included).
|
||
|
|
|
||
|
|
1. Introduction.
|
||
|
|
This was the first key generator I ever wrote. It taught me more about
|
||
|
|
assembly than any book I've read, considering that I originally
|
||
|
|
learned assembly from debugging stuff.
|
||
|
|
|
||
|
|
This is a very easy keygen to do, but you use the same process to write
|
||
|
|
other much more complex keygens.
|
||
|
|
|
||
|
|
The best way of writing a keygen in my experience is:
|
||
|
|
1. Debug, dissasemble, do whatever is necessary to UNDERSTAND what the hell
|
||
|
|
the program is doing.
|
||
|
|
2. Extract the relevant code, reverse it or whatever needs doing to make it
|
||
|
|
ready for the keygen.
|
||
|
|
3. Write the keygen.
|
||
|
|
4. Use a key you made, debug the program, and make sure it works 101%.
|
||
|
|
|
||
|
|
2. Let's Get Started!
|
||
|
|
Ok, look at the program, how it runs. See if it prompts for a reg number,
|
||
|
|
if it looks for a key file, any way it gets registration in.
|
||
|
|
|
||
|
|
With X-Tract, there are no prompts for reg numbers, or anything.
|
||
|
|
Ok, so now you run a file access monitor, to check if it looks for a reg
|
||
|
|
key. (I have included a good file access monitor with the package, SCANF.
|
||
|
|
To make it put file access up on the screen, use "scanf con" to run it)
|
||
|
|
Bingo. It looks for X-TRACT.KEY.
|
||
|
|
|
||
|
|
Now the debugging starts. First create a file called X-TRACT.KEY in the
|
||
|
|
same directory as X-Tract, and load your debugger. Step through with the
|
||
|
|
file access montior loaded to see where it opens the key file.
|
||
|
|
|
||
|
|
You trace over the following call, and the file monitor tells you that the
|
||
|
|
key has been opened.
|
||
|
|
|
||
|
|
cs:366B 2EA27908 mov cs:[0879],al
|
||
|
|
cs:366F 9C pushf
|
||
|
|
cs:3670 E8D71A call 514A
|
||
|
|
|
||
|
|
Now you restart debugging and trace one instruction into that function call.
|
||
|
|
You trace over the first function call, and notice that it displays the
|
||
|
|
startup banner:
|
||
|
|
X-TRACT (tm) Executable File Extractor Version 1.51 7-26-95
|
||
|
|
Copyright 1994-95 by Pablo Carboni. All Rights Reserved.
|
||
|
|
|
||
|
|
The next block of code uses an Int 21h call.
|
||
|
|
You notice that this is what opens the file.
|
||
|
|
Int 21h's usage is as follows:
|
||
|
|
ah = 3D ; Open file Handle for file access
|
||
|
|
al = 02 ; file access code
|
||
|
|
dx = filename offset ; Where the filename is in memory
|
||
|
|
Int 21h ; Try to open the file
|
||
|
|
jnb ok ; If the file exists, and has been opened, jump
|
||
|
|
jmp error ; If the file hasn't been opened, jump.
|
||
|
|
|
||
|
|
So what this block of code does is try and open the file.
|
||
|
|
cs:5150 B8023D mov ax,3D02
|
||
|
|
cs:5153 BAFC21 mov dx,21FC
|
||
|
|
cs:5156 CD21 int 21
|
||
|
|
cs:5158 7303 jnb 515D
|
||
|
|
cs:515A E9ED00 jmp 524A
|
||
|
|
|
||
|
|
Since you made a file called X-TRACT.KEY before you started debugging
|
||
|
|
it should jump on the first jump.
|
||
|
|
You then end up here:
|
||
|
|
cs:515D 2EA3D805 mov cs:[05D8],ax
|
||
|
|
cs:5161 B43F mov ah,3F
|
||
|
|
cs:5163 2E8B1ED805 mov bx,cs:[05D8]
|
||
|
|
cs:5168 B99B00 mov cx,009B
|
||
|
|
cs:516B BABD00 mov dx,00BD
|
||
|
|
cs:516E CD21 int 21
|
||
|
|
cs:5170 3D9B00 cmp ax,009B
|
||
|
|
cs:5173 7303 jnb 5178
|
||
|
|
cs:5175 E9D200 jmp 524A
|
||
|
|
|
||
|
|
The first line stores the files handle for future access from AX to
|
||
|
|
memory location 05D8h.
|
||
|
|
|
||
|
|
Now, we see another Int 21h call coming up. This time it is as follows:
|
||
|
|
ah = 3Fh ; Read Data from the open filehandle in BX
|
||
|
|
bx = [05D8h] ; get the file handle we saved just before.
|
||
|
|
cx = 9Bh ; How many bytes we want to try and read.
|
||
|
|
dx = 0BDh ; Where we want to put the read bytes.
|
||
|
|
Int 21h ; Do the deed
|
||
|
|
|
||
|
|
When this returns, AX will be the actual number of bytes read from the file.
|
||
|
|
So what is this next piece of code doing?
|
||
|
|
cs:5170 3D9B00 cmp ax,009B
|
||
|
|
cs:5173 7303 jnb 5178
|
||
|
|
cs:5175 E9D200 jmp 524A
|
||
|
|
Its checking if it could read 9Bh bytes from the file, and if it could,
|
||
|
|
continue.
|
||
|
|
|
||
|
|
As you should have noticed, if any of the previous tests have failed, they
|
||
|
|
jump to location 524Ah. Keep this in mind when you are debugging the code.
|
||
|
|
|
||
|
|
Now you hit this big lump of code:
|
||
|
|
cs:5178 BEBD00 mov si,00BD
|
||
|
|
cs:517B BF5521 mov di,2155
|
||
|
|
cs:517E B99A00 mov cx,009A
|
||
|
|
cs:5181 0E push cs
|
||
|
|
cs:5182 1F pop ds
|
||
|
|
cs:5183 0E push cs
|
||
|
|
cs:5184 07 pop es
|
||
|
|
cs:5185 FC cld
|
||
|
|
cs:5186 F3A6 rep cmpsb
|
||
|
|
cs:5188 7403 je 518D
|
||
|
|
cs:518A E9BD00 jmp 524A
|
||
|
|
rep cmpsb....... hmmm, a byte-by-byte compare statement.
|
||
|
|
how this is called is:
|
||
|
|
cx = Number of bytes to compare
|
||
|
|
DS:DI = First lot of bytes to compare
|
||
|
|
ES:SI = Second lot of bytes to compare
|
||
|
|
rep cmpsb ; do the compare
|
||
|
|
je continue ; jump here it the same
|
||
|
|
jmp error ; jump here if not the same
|
||
|
|
|
||
|
|
So what should be at the start of the rego key?
|
||
|
|
Whatever is at ES:DI. The other location has what was in the rego key
|
||
|
|
that you created.
|
||
|
|
|
||
|
|
Now you get to this:
|
||
|
|
cs:518D AC lodsb
|
||
|
|
cs:518E 3CE0 cmp al,E0
|
||
|
|
cs:5190 741B je 51AD
|
||
|
|
And a few more with different compares. It is checking if one of these
|
||
|
|
is equal to the byte it loaded from DS:DI (its there from after the 1st
|
||
|
|
compare).
|
||
|
|
|
||
|
|
Could it be checking for the type of registration? Lets continue and see.
|
||
|
|
cs:51AD 2EA28008 mov cs:[0880],al
|
||
|
|
cs:51B1 B43F mov ah,3F
|
||
|
|
cs:51B3 2E8B1ED805 mov bx,cs:[05D8]
|
||
|
|
cs:51B8 B92A00 mov cx,002A
|
||
|
|
cs:51BB BABD00 mov dx,00BD
|
||
|
|
cs:51BE CD21 int 21
|
||
|
|
cs:51C0 3D2A00 cmp ax,002A
|
||
|
|
cs:51C3 7403 je 51C8
|
||
|
|
cs:51C5 E98200 jmp 524A
|
||
|
|
|
||
|
|
It saves the byte it just checked to cs:880h.
|
||
|
|
Then it does what it did before with Int 21h, it reads 2Ah bytes from the
|
||
|
|
file to ds:00BDh. If it could read 2Ah bytes, it continues on, otherwise
|
||
|
|
it quits.
|
||
|
|
|
||
|
|
Now would be a good time to get out of the debugger and make the key file.
|
||
|
|
9Bh + 2Ah bytes (add the two cx vaules from the file read Int 21h's) is
|
||
|
|
equal to 197 bytes, so now would be a good time to get out, make a file of
|
||
|
|
size 197 bytes, With the first lot of data it compared (that string of
|
||
|
|
bytes), then either a E0h, E1h, E2h or E3h, which it looked for. I will
|
||
|
|
use a E0h.
|
||
|
|
|
||
|
|
You've got your registration key half done. After making it, you
|
||
|
|
should be able to pass all of the tests it performs to the point where we
|
||
|
|
left off. If you had problems, have a look at the key that I provided
|
||
|
|
called XLOGIC.REG to get some hints.
|
||
|
|
|
||
|
|
Now you hit this:
|
||
|
|
cs:51C8 BEBD00 mov si,00BD
|
||
|
|
cs:51CB 8BFE mov di,si
|
||
|
|
cs:51CD B92A00 mov cx,002A
|
||
|
|
cs:51D0 2E8A1E8008 mov bl,cs:[0880]
|
||
|
|
cs:51D5 AC lodsb
|
||
|
|
cs:51D6 32C3 xor al,bl
|
||
|
|
cs:51D8 AA stosb
|
||
|
|
cs:51D9 80EB22 sub bl,22
|
||
|
|
cs:51DC E2F7 loop 51D5
|
||
|
|
|
||
|
|
Now before i tell you, try and work out what this does.
|
||
|
|
|
||
|
|
Here is what it is doing:
|
||
|
|
1. si = 0BDh ;the location to start from
|
||
|
|
2. di = si ;set the second location to start from
|
||
|
|
3. cx = 2Ah ;how many times to loop
|
||
|
|
4. bl = cs:880h ;get that byte that it checked for earlier
|
||
|
|
5. lodsb ;load a byte from ES:SI into al, increment si by 1
|
||
|
|
6. xor al,bl ;xor al by bl
|
||
|
|
7. stosb ;store al to DS:DI, increment di by 1
|
||
|
|
8. sub bl,22 ;decrement bl by 22h
|
||
|
|
9. loop 5 ;loop cx times.
|
||
|
|
|
||
|
|
Now, step through this, watching what this does.
|
||
|
|
What does it do?
|
||
|
|
It decripts the data after the 0E0h, in the keyfile, using the above process.
|
||
|
|
|
||
|
|
If you can't understand this, just keep watching it and debugging it,
|
||
|
|
because if you can't understand this, you won't be able to write a keygen.
|
||
|
|
|
||
|
|
Now it has tried to decrypt your name, and what we're about to look at.
|
||
|
|
|
||
|
|
Check this code out:
|
||
|
|
cs:51DE BEBD00 mov si,00BD
|
||
|
|
cs:51E1 8BFE mov di,si
|
||
|
|
cs:51E3 B92800 mov cx,0028
|
||
|
|
cs:51E6 2E8A1E8008 mov bl,cs:[0880]
|
||
|
|
cs:51EB 33D2 xor dx,dx
|
||
|
|
cs:51ED 33C0 xor ax,ax
|
||
|
|
cs:51EF AC lodsb
|
||
|
|
cs:51F0 03D0 add dx,ax
|
||
|
|
cs:51F2 E2FB loop 51EF
|
||
|
|
cs:51F4 2E3B14 cmp dx,cs:[si]
|
||
|
|
cs:51F7 7551 jne 524A
|
||
|
|
|
||
|
|
Whats it doing?
|
||
|
|
You should understand the first 7 lines, actually, you should understand
|
||
|
|
the whole thing if you have a good grasp of Assembly.
|
||
|
|
|
||
|
|
It adds all the bytes together of what "Should" be you name, into dx.
|
||
|
|
Then it compares dx to the number stored at cs:si. This is what is called
|
||
|
|
a CRC check. This is only a simple one, and all it does is check if any
|
||
|
|
of the bytes in the string have changed.
|
||
|
|
|
||
|
|
If it is the same, it is ok, and continues, otherwise it quits.
|
||
|
|
|
||
|
|
Now it sets cs:2220 to 01h, to tell the program it is registered.
|
||
|
|
cs:51FC 2EC606202201 mov cs:byte ptr [2220]
|
||
|
|
Then it checks the 0E0h byte. This is where we find out what it does.
|
||
|
|
cs:5202 2E803E8008E0 cmp cs:byte ptr [0880]
|
||
|
|
cs:5208 7424 je 522E
|
||
|
|
So we let it jump:
|
||
|
|
cs:522E BA9B22 mov dx,229B
|
||
|
|
cs:5231 E81D00 call 5251
|
||
|
|
cs:5234 C3 ret
|
||
|
|
And it prints on the screen "REGISTERED VERSION".
|
||
|
|
So what do the other "0E?h" values do?
|
||
|
|
Go back and try the others to find out for yourself.
|
||
|
|
|
||
|
|
IMPORTANT.
|
||
|
|
If you don't understand all of the above, go over and over it until you do.
|
||
|
|
|
||
|
|
|
||
|
|
2. Writing The KeyGen.
|
||
|
|
|
||
|
|
Now I am going to get lazy. I will tell you what the steps are,
|
||
|
|
give you my commented source file, and leave you go from there.
|
||
|
|
|
||
|
|
Here is what it is doing:
|
||
|
|
1. Open the Rego File.
|
||
|
|
2. Read the Header.
|
||
|
|
3. Check it.
|
||
|
|
4. Read the Rego Name and CRC.
|
||
|
|
5. Decrypt them.
|
||
|
|
6. Calculate the CRC.
|
||
|
|
7. Check the CRC.
|
||
|
|
8. Display the Rego type.
|
||
|
|
9. Continue on with the program.
|
||
|
|
|
||
|
|
Here is what you have to do:
|
||
|
|
1. Read the Rego Name.
|
||
|
|
2. Calculate the CRC.
|
||
|
|
3. Encript the Rego name and CRC.
|
||
|
|
3. Store the Rego type.
|
||
|
|
4. Write the whole block (including the header) to the Rego file.
|
||
|
|
|
||
|
|
Now for the assembly file:
|
||
|
|
-------------------------------------------------------------------------------
|
||
|
|
.386p
|
||
|
|
seg_a segment byte public use16
|
||
|
|
assume cs:seg_a, ds:seg_a
|
||
|
|
|
||
|
|
org 100h
|
||
|
|
|
||
|
|
xtract_keygen Proc Far
|
||
|
|
start:
|
||
|
|
mov dx,offset title_text ;load the startup banner
|
||
|
|
call print_text ;print it on the screen
|
||
|
|
mov dx,offset max_ent_length ;load the text entry offset
|
||
|
|
mov ah,0Ah ;function=get text string
|
||
|
|
int 21h ;get the text
|
||
|
|
cmp byte ptr entry_length,01h ;check if mor than 1
|
||
|
|
;character was entered
|
||
|
|
jae short reg_type_sel ;jump if 1 or more
|
||
|
|
mov dx,offset no_entry ;not enough was entered
|
||
|
|
jmp short exit ;jump to exit
|
||
|
|
|
||
|
|
reg_type_sel:
|
||
|
|
mov dx,offset reg_type_text ;load rego type selection
|
||
|
|
call print_text ;display it
|
||
|
|
xor ax,ax ;clear ax
|
||
|
|
int 16h ;get a char from the keybd
|
||
|
|
int 29h ;display it
|
||
|
|
cmp al,31h ;check if its 1
|
||
|
|
jl reg_type_sel ;jmp if lower than
|
||
|
|
cmp al,34h ;check if its 4
|
||
|
|
ja reg_type_sel ;jmp if above
|
||
|
|
continue:
|
||
|
|
add al,0AFh ;add 0AFh to input, to get
|
||
|
|
;"E" value.
|
||
|
|
mov reg_type,al ;store it in the rego type
|
||
|
|
mov dl,0Ah ;1 These lines store
|
||
|
|
mov dh,al ;2 the rego type
|
||
|
|
mov bx,offset max_ent_length ;3
|
||
|
|
mov [bx],dx ;4
|
||
|
|
call make_key ;make the key
|
||
|
|
mov dx,offset done_text ;load done text
|
||
|
|
exit:
|
||
|
|
call print_text ;display the output result
|
||
|
|
retn ;exit to dos/windoze
|
||
|
|
xtract_keygen endp
|
||
|
|
|
||
|
|
print_text proc near ;put text up on the
|
||
|
|
mov ah,9 ;screen
|
||
|
|
int 21h
|
||
|
|
retn
|
||
|
|
print_text endp
|
||
|
|
|
||
|
|
make_key proc near
|
||
|
|
mov si,offset name_input ;this should look
|
||
|
|
mov dx,si ;familiar :)
|
||
|
|
mov cx,28h ;
|
||
|
|
mov bl,reg_type ;
|
||
|
|
xor dx,dx ;
|
||
|
|
xor ax,ax ;
|
||
|
|
crc_loop: ;
|
||
|
|
lodsb ;
|
||
|
|
add dx,ax ;
|
||
|
|
loop crc_loop ;
|
||
|
|
mov bx,offset checksum_dat ;
|
||
|
|
mov [bx],dx ;store the crc
|
||
|
|
|
||
|
|
mov si,offset name_input ;this should also look
|
||
|
|
mov di,si ;familiar :)
|
||
|
|
mov cx,2Ah ;
|
||
|
|
mov bl,reg_type ;
|
||
|
|
encription_loop: ;
|
||
|
|
lodsb ;
|
||
|
|
xor al,bl ;
|
||
|
|
stosb ;
|
||
|
|
sub bl,22h ;
|
||
|
|
loop encription_loop ;
|
||
|
|
|
||
|
|
mov ah,3Ch ;open the file to write
|
||
|
|
mov dx,offset key_name ;
|
||
|
|
int 21h ;
|
||
|
|
xchg bx,ax ;put filehand in bx
|
||
|
|
mov ah,40h ;write the key to disk
|
||
|
|
mov dx,offset key_data ;
|
||
|
|
mov cx,0C5h ;
|
||
|
|
int 21h ;
|
||
|
|
mov ah,3Eh ;close the file handle
|
||
|
|
int 21h ;
|
||
|
|
retn
|
||
|
|
make_key endp
|
||
|
|
|
||
|
|
title_text db 'X-Tract 1.51 Key File Generator by XLogic', 0Dh, 0Ah
|
||
|
|
name_prompt db 'Enter your name: $'
|
||
|
|
reg_type_text db 0Dh,0Ah,'Please Choose Registration Type:',0Dh,0Ah
|
||
|
|
db '1. Registered Version',0Dh,0Ah
|
||
|
|
db '2. Beta-Test Version',0Dh,0Ah
|
||
|
|
db '3. Distro-Site Version',0Dh,0Ah
|
||
|
|
db '4. Special Version',0Dh,0Ah
|
||
|
|
db 'Enter the number corresponding to the type: $'
|
||
|
|
no_entry db 0Dh,0Ah,'You must enter a name.$'
|
||
|
|
done_text db 0Dh,0Ah,'Key file X-TRACT.KEY created.$'
|
||
|
|
key_name db 'X-TRACT.KEY',0
|
||
|
|
reg_type db 0
|
||
|
|
key_data dd 073696854h,020736920h,072756F79h,067657220h,072747369h,06F697461h,0656B206Eh,06F662079h
|
||
|
|
dd 02D582072h,043415254h,050202E54h,07361656Ch,064202C65h,06F6E206Fh,069642074h,069727473h
|
||
|
|
dd 065747562h,021746920h,063280A0Dh,039312029h,062203439h,06F572079h,02C79646Fh,065754220h
|
||
|
|
dd 020736F6Eh,065726941h,041202C73h,04E454752h,0414E4954h,06150202Eh,0206F6C62h,06576694Ch
|
||
|
|
dd 06F532073h,06877656Dh,020657265h,054206E49h,054206568h,02E656D69h
|
||
|
|
db 0Dh
|
||
|
|
max_ent_length db 26h
|
||
|
|
entry_length db 0
|
||
|
|
name_input db 40 dup ('$')
|
||
|
|
checksum_dat db 2 dup (0)
|
||
|
|
seg_a ends
|
||
|
|
end start
|
||
|
|
-------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
Ok, there it is in all its glory. I hope you've learned something from this,
|
||
|
|
and if you did, let me know. If you didn't, good for you. Tell me how to
|
||
|
|
improve this tutorial.
|
||
|
|
|
||
|
|
I can be contacted in #PC97 or #cracking on EFNET.
|
||
|
|
|
||
|
|
Cya Round.
|
||
|
|
|
||
|
|
XLogic.
|
||
|
|
|