Jump to content
Tuts 4 You

[KeygenMe] KeygenMe v1.4

Greedy_Fly

By Greedy_Fly
in KeygenMe

 Share

Recommended Posts

Greedy_Fly

Greedy_Fly

Posted
Posted

Hi... All !!! ... Try It!


 


Level - ? (Tell me if you know)


Rules: Only Keygen,  Not Patching,  Not Serial Fishing...


------------------------------------------------------------------------


Greedy_Fly


 


KeygenMe.zip


Link to comment
Share on other sites
Arkimonde

Arkimonde

Posted
Posted

Hi, Arkimonde.... Your keygen doesn't work on my computer... ( missing dll)

Sorry it's was made using RAD and is needed some libs to work, but now I did with MSVC, should work fine if you have Microsoft Visual C++ 2010 Redistributable Package.

 

keygentuts.rar

Link to comment
Share on other sites
  • 8 years later...
  • 5 months later...
Sean Park

Sean Park

Posted
Posted (edited)

hey guys. I found the key algorithm of your keygenme. and decompiled them to c++ code with the help of  the hex-ray ida pro decompiler, but I need your help to assemble the codes in visual studio 2022 community edition. can you please give me hands to create the keygen with vs 2022 community edition? 

Key Algorithm Routine
----------
INT_PTR __userpurge DialogFunc@<eax>(int a1@<esi>, HWND hWnd, UINT a3, WPARAM a4, LPARAM a5)
{
  int v5; // esi
  HWND v6; // eax
  HWND v7; // eax
  HWND v8; // eax
  HWND v9; // eax
  HWND v10; // eax

  switch ( a3 )
  {
    case 0x110u:
      LoadIconA(hInstance, (LPCSTR)0xC8);
      SendMessageA(hWnd, 0x80u, 1u, lParam);
      ::hWnd = GetDlgItem(hWnd, 101);
      SendMessageA(::hWnd, 0xCu, 0, (LPARAM)aHi);
      break;
    case 0x111u:
      if ( a4 == 402 )
      {
        dword_405078 = GetDlgItem(hWnd, 405);
        SendMessageA(dword_405078, 0xDu, 0x20u, (LPARAM)&UserName_plus_01);
        sub_402944();
        if ( a1 != 67936 )
          goto LABEL_10;
        sub_4027F4();
        sub_40110E(&unk_40401C);
        sub_40130E(&UserName_plus_01, &Buffer0);
        sub_4027FF(&Buffer0);
        RtlZeroMemory(&UserName_plus_01, 32);
        dword_40507C = GetDlgItem(hWnd, 406);
        if ( SendMessageA(dword_40507C, 0xDu, 0x20u, (LPARAM)&UserInpuKey) != 16 )
          goto LABEL_10;
        sub_402829(&UserInpuKey, &Buffer1);
        v5 = sub_4029D0(&Buffer0);
        if ( v5 == sub_4029D0(&Buffer1) && !memcmp(&Buffer0, &Buffer1, 8u) )
        {
          v6 = GetDlgItem(hWnd, 102);
          ShowWindow(v6, 1);
          v7 = GetDlgItem(hWnd, 402);
          EnableWindow(v7, 0);
          v8 = GetDlgItem(hWnd, 405);
          EnableWindow(v8, 0);
          v9 = GetDlgItem(hWnd, 406);
          EnableWindow(v9, 0);
        }
        else
        {
LABEL_10:
          v10 = GetDlgItem(hWnd, 404);
          SendMessageA(v10, 0xF5u, 0, 0);
        }
      }
      else if ( a4 == 404 )
      {
        SendMessageA(hWnd, 0x10u, 0, 0);
      }
      break;
    case 0x10u:
      EndDialog(hWnd, 0);
      break;
  }
  return 0;
}
---------------------





sub_402944      
             inc     ebx
           shl     ebx, 4
           mov     esi, 40h ; '@'
              lea     edi, [ebx+esi]
              imul    ebx, edi, 182h
                xor     esi, esi
              xchg    esi, ebx
                 sub     ebx, ebx
                retn


---------------
void __stdcall sub_40130E(_DWORD *UserName_plus_01, int *buffer0)
{
  int v2; // ebp
  int v3; // eax
  int v4; // ebx
  int v5; // ebp
  unsigned int v6; // ebx
  int v7; // eax
  int v8; // ebp
  unsigned int v9; // eax
  int v10; // ebx
  int v11; // ebp
  unsigned int v12; // ebx
  int v13; // eax
  int v14; // ebp
  unsigned int v15; // eax
  unsigned int v16; // edx
  int v17; // ebx
  unsigned int v18; // edx
  int v19; // eax
  unsigned int v20; // edx
  int v21; // ebx
  unsigned int v22; // edx
  int v23; // eax
  unsigned int v24; // edx
  int v25; // ebx
  unsigned int v26; // edx
  int v27; // eax
  unsigned int v28; // edx
  int v29; // ebx
  unsigned int v30; // edx
  int v31; // eax
  unsigned int v32; // edx
  int v33; // ebx
  unsigned int v34; // edx
  int v35; // eax
  unsigned int v36; // edx
  int v37; // ebx
  unsigned int v38; // edx
  int v39; // eax
  unsigned int v40; // edx
  int v41; // ebx
  unsigned int v42; // edx
  int v43; // eax
  unsigned int v44; // edx
  int v45; // ebx
  unsigned int v46; // edx
  unsigned int v47; // eax
  int v48; // ebx
  int v49; // ebp
  unsigned int v50; // ebx
  int v51; // eax
  int v52; // ebp
  unsigned int v53; // eax
  int v54; // ebx
  int v55; // ebp
  int v56; // ebx
  int v57; // eax
  int v58; // ebp
  unsigned int v59; // eax
  int v60; // ebx
  int v61; // ebp

  v2 = (*UserName_plus_01 ^ (UserName_plus_01[1] >> 4)) & 0xF0F0F0F;
  v3 = v2 ^ *UserName_plus_01;
  v4 = (16 * v2) ^ UserName_plus_01[1];
  v5 = (unsigned __int16)(v4 ^ HIWORD(v3));
  v6 = v5 ^ v4;
  v7 = (v5 << 16) ^ v3;
  v8 = (v7 ^ (v6 >> 2)) & 0x33333333;
  v9 = v8 ^ v7;
  v10 = (4 * v8) ^ v6;
  v11 = (v10 ^ (v9 >> 8)) & 0xFF00FF;
  v12 = v11 ^ v10;
  v13 = (v11 << 8) ^ v9;
  v14 = (v13 ^ (v12 >> 1)) & 0x55555555;
  v15 = __ROR4__(v14 ^ v13, 29);
  v16 = __ROR4__(dword_405118[0] ^ v15, 4);
  v17 = dword_404F2A[v16 >> 26] ^ dword_404D2A[(v16 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v16 >> 10] ^ dword_40492A[(unsigned __int8)v16 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405114[0] ^ v15) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(LOWORD(dword_405114[0]) ^ v15) >> 8) >> 2] ^ dword_40482A[((dword_405114[0] ^ v15) >> 2) & 0x3F] ^ __ROR4__((2 * v14) ^ v12, 29);
  v18 = __ROR4__(dword_405120 ^ v17, 4);
  v19 = dword_404F2A[v18 >> 26] ^ dword_404D2A[(v18 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v18 >> 10] ^ dword_40492A[(unsigned __int8)v18 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40511C ^ (unsigned int)v17) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40511C ^ v17) >> 8) >> 2] ^ dword_40482A[((dword_40511C ^ (unsigned int)v17) >> 2) & 0x3F] ^ v15;
  v20 = __ROR4__(dword_405128 ^ v19, 4);
  v21 = dword_404F2A[v20 >> 26] ^ dword_404D2A[(v20 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v20 >> 10] ^ dword_40492A[(unsigned __int8)v20 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405124 ^ (unsigned int)v19) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_405124 ^ v19) >> 8) >> 2] ^ dword_40482A[((dword_405124 ^ (unsigned int)v19) >> 2) & 0x3F] ^ v17;
  v22 = __ROR4__(dword_405130 ^ v21, 4);
  v23 = dword_404F2A[v22 >> 26] ^ dword_404D2A[(v22 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v22 >> 10] ^ dword_40492A[(unsigned __int8)v22 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40512C ^ (unsigned int)v21) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40512C ^ v21) >> 8) >> 2] ^ dword_40482A[((dword_40512C ^ (unsigned int)v21) >> 2) & 0x3F] ^ v19;
  v24 = __ROR4__(dword_405138 ^ v23, 4);
  v25 = dword_404F2A[v24 >> 26] ^ dword_404D2A[(v24 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v24 >> 10] ^ dword_40492A[(unsigned __int8)v24 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405134 ^ (unsigned int)v23) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_405134 ^ v23) >> 8) >> 2] ^ dword_40482A[((dword_405134 ^ (unsigned int)v23) >> 2) & 0x3F] ^ v21;
  v26 = __ROR4__(dword_405140 ^ v25, 4);
  v27 = dword_404F2A[v26 >> 26] ^ dword_404D2A[(v26 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v26 >> 10] ^ dword_40492A[(unsigned __int8)v26 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40513C ^ (unsigned int)v25) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40513C ^ v25) >> 8) >> 2] ^ dword_40482A[((dword_40513C ^ (unsigned int)v25) >> 2) & 0x3F] ^ v23;
  v28 = __ROR4__(dword_405148 ^ v27, 4);
  v29 = dword_404F2A[v28 >> 26] ^ dword_404D2A[(v28 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v28 >> 10] ^ dword_40492A[(unsigned __int8)v28 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405144 ^ (unsigned int)v27) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_405144 ^ v27) >> 8) >> 2] ^ dword_40482A[((dword_405144 ^ (unsigned int)v27) >> 2) & 0x3F] ^ v25;
  v30 = __ROR4__(dword_405150 ^ v29, 4);
  v31 = dword_404F2A[v30 >> 26] ^ dword_404D2A[(v30 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v30 >> 10] ^ dword_40492A[(unsigned __int8)v30 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40514C ^ (unsigned int)v29) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40514C ^ v29) >> 8) >> 2] ^ dword_40482A[((dword_40514C ^ (unsigned int)v29) >> 2) & 0x3F] ^ v27;
  v32 = __ROR4__(dword_405158 ^ v31, 4);
  v33 = dword_404F2A[v32 >> 26] ^ dword_404D2A[(v32 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v32 >> 10] ^ dword_40492A[(unsigned __int8)v32 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405154 ^ (unsigned int)v31) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_405154 ^ v31) >> 8) >> 2] ^ dword_40482A[((dword_405154 ^ (unsigned int)v31) >> 2) & 0x3F] ^ v29;
  v34 = __ROR4__(dword_405160 ^ v33, 4);
  v35 = dword_404F2A[v34 >> 26] ^ dword_404D2A[(v34 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v34 >> 10] ^ dword_40492A[(unsigned __int8)v34 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40515C ^ (unsigned int)v33) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40515C ^ v33) >> 8) >> 2] ^ dword_40482A[((dword_40515C ^ (unsigned int)v33) >> 2) & 0x3F] ^ v31;
  v36 = __ROR4__(dword_405168 ^ v35, 4);
  v37 = dword_404F2A[v36 >> 26] ^ dword_404D2A[(v36 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v36 >> 10] ^ dword_40492A[(unsigned __int8)v36 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405164 ^ (unsigned int)v35) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_405164 ^ v35) >> 8) >> 2] ^ dword_40482A[((dword_405164 ^ (unsigned int)v35) >> 2) & 0x3F] ^ v33;
  v38 = __ROR4__(dword_405170 ^ v37, 4);
  v39 = dword_404F2A[v38 >> 26] ^ dword_404D2A[(v38 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v38 >> 10] ^ dword_40492A[(unsigned __int8)v38 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40516C ^ (unsigned int)v37) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40516C ^ v37) >> 8) >> 2] ^ dword_40482A[((dword_40516C ^ (unsigned int)v37) >> 2) & 0x3F] ^ v35;
  v40 = __ROR4__(dword_405178 ^ v39, 4);
  v41 = dword_404F2A[v40 >> 26] ^ dword_404D2A[(v40 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v40 >> 10] ^ dword_40492A[(unsigned __int8)v40 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405174 ^ (unsigned int)v39) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_405174 ^ v39) >> 8) >> 2] ^ dword_40482A[((dword_405174 ^ (unsigned int)v39) >> 2) & 0x3F] ^ v37;
  v42 = __ROR4__(dword_405180 ^ v41, 4);
  v43 = dword_404F2A[v42 >> 26] ^ dword_404D2A[(v42 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v42 >> 10] ^ dword_40492A[(unsigned __int8)v42 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40517C ^ (unsigned int)v41) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40517C ^ v41) >> 8) >> 2] ^ dword_40482A[((dword_40517C ^ (unsigned int)v41) >> 2) & 0x3F] ^ v39;
  v44 = __ROR4__(dword_405188 ^ v43, 4);
  v45 = dword_404F2A[v44 >> 26] ^ dword_404D2A[(v44 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v44 >> 10] ^ dword_40492A[(unsigned __int8)v44 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_405184 ^ (unsigned int)v43) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_405184 ^ v43) >> 8) >> 2] ^ dword_40482A[((dword_405184 ^ (unsigned int)v43) >> 2) & 0x3F] ^ v41;
  v46 = __ROR4__(dword_405190 ^ v45, 4);
  v47 = __ROR4__(
          dword_404F2A[v46 >> 26] ^ dword_404D2A[(v46 >> 18) & 0x3F] ^ dword_404B2A[(unsigned __int16)v46 >> 10] ^ dword_40492A[(unsigned __int8)v46 >> 2] ^ dword_404E2A ^ dword_404C2A[((dword_40518C ^ (unsigned int)v45) >> 18) & 0x3F] ^ dword_404A2A[(unsigned __int8)((unsigned __int16)(dword_40518C ^ v45) >> 8) >> 2] ^ dword_40482A[((dword_40518C ^ (unsigned int)v45) >> 2) & 0x3F] ^ v43,
          3);
  v48 = __ROR4__(v45, 3);
  v49 = (v48 ^ (v47 >> 1)) & 0x55555555;
  v50 = v49 ^ v48;
  v51 = (2 * v49) ^ v47;
  v52 = (v51 ^ (v50 >> 8)) & 0xFF00FF;
  v53 = v52 ^ v51;
  v54 = (v52 << 8) ^ v50;
  v55 = (v54 ^ (v53 >> 2)) & 0x33333333;
  v56 = v55 ^ v54;
  v57 = (4 * v55) ^ v53;
  v58 = (unsigned __int16)(v57 ^ HIWORD(v56));
  v59 = v58 ^ v57;
  v60 = (v58 << 16) ^ v56;
  v61 = (v60 ^ (v59 >> 4)) & 0xF0F0F0F;
  *buffer0 = v61 ^ v60;
  buffer0[1] = (16 * v61) ^ v59;
}


----------------
int __userpurge sub_402829@<eax>(int result@<eax>, unsigned __int8 *user_val, _BYTE *buffer1)
{
  unsigned int v5; // edx
  unsigned __int8 *v6; // esi
  int v7; // ebx
  unsigned int v8; // edx
  int v9; // ebx

  while ( 1 )
  {
    v5 = *user_val;
    v6 = user_val + 1;
    v7 = v5 - 55 + (v5 < 0x40 ? 7 : 0);
    if ( v7 < 0 )
      break;
    result = 16 * v7;
    *buffer1 = 16 * v7;
    v8 = *v6;
    user_val = v6 + 1;
    v9 = v8 - 55 + (v8 < 0x40 ? 7 : 0);
    if ( v9 < 0 )
      break;
    result += v9 & 0xF;
    *buffer1++ = result;
  }
  return result;

-------------------

char *__stdcall sub_4029D0(int *buffer0)
{
  int *v1; // eax
  int v2; // edi
  unsigned int v3; // ecx
  int v4; // edi
  int v5; // edi
  int v6; // edi

  v1 = buffer0;
  do
  {
    v2 = *v1++;
    v3 = ~v2 & (v2 - 16843009) & 0x80808080;
    if ( v3 )
      break;
    v4 = *v1++;
    v3 = ~v4 & (v4 - 16843009) & 0x80808080;
    if ( v3 )
      break;
    v5 = *v1++;
    v3 = ~v5 & (v5 - 16843009) & 0x80808080;
    if ( v3 )
      break;
    v6 = *v1++;
    v3 = ~v6 & (v6 - 16843009) & 0x80808080;
  }
  while ( !v3 );
  if ( (v3 & 0x8080) == 0 )
  {
    v3 >>= 16;
    v1 = (int *)((char *)v1 + 2);
  }
  return (char *)((char *)v1 - ((char *)buffer0 + __CFSHL__(v3, 1) + 3));
}

if you can pm me , can you send me pms?

thank you in advance.

regards.

sean.

Edited by Sean Park
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...