[KeygenMe] Windev 9 Sample KeygenMe

[Pushad]

This Sample Keygen Me Made Via Windev 9 i hope ther a tutorials for keygening

WD9 Keygen.rar

[kao]

Sample user/key

kao : 3akD

Tuts4You : Af1sbKR+TQ0

Put breakpoint on this code:

and enter any serial. Breakpoint will trigger, in ESI will be entered serial, in EDI - correct serial.

25F00BDD   83C6 10          ADD ESI,1025F00BE0   8BCA             MOV ECX,EDX25F00BE2   33C0             XOR EAX,EAX25F00BE4  > F3:A6            REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>25F00BE6   5F               POP EDI25F00BE7   74 05            JE SHORT WD90VM.25F00BEE

No, I will not provide a keygen. It's too easy to be even remotely interesting.

[mArTi]

@kao you are missing the point that WinDev code is some bytecode compiled at runtime, not some "usual native crackme", which is unusual. (unlike .NET/Java bytecode, here the bytecode is encrypted, opcodes/bytecodes are not documented at all, nor is the jit).

 

Saying "too easy" just because you fished a serial on a keygenme is a bit presumptuous.

 

But note that usual WinDev coders are not "brains" (so serial protection on WinDev softwares are pretty low) and that latest WinDev version is something around 19 (and not 9, even if the VM didn't evolve that much).

 

EDIT: this old version is "less interesting" than following ones, VM-wise, but still.

Edited January 12, 2015 by mArTi

[kao]

@mArTi: Yes, WinDev code is P-Code and the opcodes are undocumented. So what? The fact that I was able to fish a valid serial just proves your point (and mine).

To make a keygen, you need to copy-paste 4 small functions from wd90std.dll. It's as fun as visiting a dentist.

Hopefully the attachment will prove my point.

P.S. I'm pretty sure there is no JIT.

keygen.zip

[mArTi]

  On 1/12/2015 at 10:09 PM, kao said:

@mArTi: Yes, WinDev code is P-Code and the opcodes are undocumented. So what? The fact that I was able to fish a valid serial just proves your point (and mine).

To make a keygen, you need to copy-paste 4 small functions from wd90std.dll. It's as fun as visiting a dentist.

Hopefully the attachment will prove my point.

P.S. I'm pretty sure there is no JIT.

 

I honestly didn't check the keygenme proposed, but since I have some "knowledge" on WinDev I told my thoughts.

In a funny way, it does confirm what I said : "note that usual WinDev coders are not "brains"" ; since you just had to copy a few wd90std funcs which are framework funcs and not user ones.

 

What I wanted to tell (esp since WD12+), is that a "normal" level keygenme routine *might* get interesting (not hardcore, and interest depends on the point of view, if you like or not undocumented bytecode getting compiled at runtime) implemented in WD12+.

Here is some archive I've got of the compiled bytecode output in some new RWE section created at runtime of a VERY easy routine in WD12 [don't mind the french text] :

https://pbs.twimg.com/media/A6y07LBCAAAgWbe.png:large

 

Anyway, sorry for having you to waste some time to proof that this keygenme is really bad (but I honestly didn't imagine someone would post something like "check serial if == Framework1Func(Framework2Func(text))", which is not interesting weither it's bytecode or not).

[Pushad]

thanks kao for keygen and mArTi