[SerialMe] SerialMe#7

[C0M3ND4D0R]

Somewhere on your hard drive (obviously not going to say, the quest is with you) was generated, a file .ini containing the correct serial. If it is easier for you, find that file. large file, but is due to skin utilized.

Good fun.

Name: SerialMe#7

Language: Autoit

Level: Easy

Packer: Not

Obfuscation: Yes

Rules: Valid Serial

Not Patching

SerialMe#7.rar

[atom0s]

Working serial:

NDY3NUE0NDQ2MzYzREIxNkFGMEJCMzdCRDI2NDZFNEK=

Other info:

- Drops file UTheme.dll in %temp%

- Writes to ini file: C:\User\Desktop\Achei.ini

Deobfuscate the code and just 'steal' the needed parts, use this to get the info:

Func _base64encode($data, $linebreak = 76)
Local $opcode = "0x5589E5FF7514535657E8410000004142434445464748494A4B4C4D4E4F505152535455565758595A6162636465666768696A6B6C6D6E6F707172737475767778797A303132333435363738392B2F005A8B5D088B7D108B4D0CE98F0000000FB633C1EE0201D68A06880731C083F901760C0FB6430125F0000000C1E8040FB63383E603C1E60409C601D68A0688470183F90176210FB6430225C0000000C1E8060FB6730183E60FC1E60209C601D68A06884702EB04C647023D83F90276100FB6730283E63F01D68A06884703EB04C647033D8D5B038D7F0483E903836DFC04750C8B45148945FC66B80D0A66AB85C90F8F69FFFFFFC607005F5E5BC9C21000"
Local $codebuffer = DllStructCreate("byte[" & BinaryLen($opcode) & "]")
DllStructSetData($codebuffer, 1, $opcode)
$data = Binary($data)
Local $input = DllStructCreate("byte[" & BinaryLen($data) & "]")
DllStructSetData($input, 1, $data)
$linebreak = Floor($linebreak / 4) * 4
Local $oputputsize = Ceiling(BinaryLen($data) * 4 / 3)
$oputputsize = $oputputsize + Ceiling($oputputsize / $linebreak) * 2 + 4
Local $ouput = DllStructCreate("char[" & $oputputsize & "]")
DllCall("user32.dll", "none", "CallWindowProc", "ptr", DllStructGetPtr($codebuffer), "ptr", DllStructGetPtr($input), "int", BinaryLen($data), "ptr", DllStructGetPtr($ouput), "uint", $linebreak)
Return DllStructGetData($ouput, 1)
EndFuncDim $code = _base64encode(omagnsrogcrtldu(",./-9,,,.+.+<.9>(::+/:<*.,.=,:"))
Dim $file = omagnsrogcrtldu(";2TMk]jT<]kclghT9[`]a&afa");MsgBox( 0, "Info", "The serial is: " & $code);
MsgBox( 0, "Info", "The file is: " & $file);Func omagnsrogcrtldu($plsjkdmhgsfhjksiew)
Local $ifgewtqghstvbbjs
For $i = 1 To StringLen($plsjkdmhgsfhjksiew)
$ifgewtqghstvbbjs = $ifgewtqghstvbbjs & Chr(Asc(StringMid($plsjkdmhgsfhjksiew, $i, 1)) + 8)
Next
Return $ifgewtqghstvbbjs
EndFunc

Edited November 25, 2012 by atom0s

[C0M3ND4D0R]

Perfect, brother

that's right. Congratulations.

Until the next.