GIV Posted August 4, 2016 Share Posted August 4, 2016 Hi guys. Today i have made a small keygenme. The algo is very simple (getting to the algo is not). Difficulty : 4Language : .NETPlatform : Windows X86/X64OS Version : XP and abovePacker / Protector : Eazfuscator Description : Simple keygenme with short computing algo. Simple Keygenme 2016 - giv.rar 1 Link to comment Share on other sites More sharing options...
Ahmad_k Posted August 4, 2016 Share Posted August 4, 2016 Stuck on deobfuscating EazFuscator. i tried eazdevirt with de4dot still no luck. so i have to change the source code of de4dot to support newer version of this obfuscator Link to comment Share on other sites More sharing options...
Insid3Code Posted August 4, 2016 Share Posted August 4, 2016 Spoiler Insid3Code 731101151051005167111100101 Nice work GIV Fishing the serial for fun! 1 Link to comment Share on other sites More sharing options...
GIV Posted August 5, 2016 Author Share Posted August 5, 2016 10 hours ago, Ahmad_k said: Stuck on deobfuscating EazFuscator. i tried eazdevirt with de4dot still no luck. so i have to change the source code of de4dot to support newer version of this obfuscator We wait for your modded de4dot. Link to comment Share on other sites More sharing options...
Ahmad_k Posted August 5, 2016 Share Posted August 5, 2016 i hope i can do it Link to comment Share on other sites More sharing options...
GIV Posted August 5, 2016 Author Share Posted August 5, 2016 Fingers crossed. Link to comment Share on other sites More sharing options...
RDGMax Posted August 5, 2016 Share Posted August 5, 2016 How is noticed the correct Message? Link to comment Share on other sites More sharing options...
GIV Posted August 5, 2016 Author Share Posted August 5, 2016 (edited) Yes the smiley is the correct serial message. Maybe i will change the algo a little bit in a new build. Edited August 5, 2016 by GIV Link to comment Share on other sites More sharing options...
Ahmad_k Posted August 5, 2016 Share Posted August 5, 2016 any clue on deobfuscating ? Link to comment Share on other sites More sharing options...
GIV Posted August 5, 2016 Author Share Posted August 5, 2016 Devirtualize the Eazfuscator VM. Link to comment Share on other sites More sharing options...
kao Posted August 5, 2016 Share Posted August 5, 2016 Sure, you can spend few days making a devirtualizer. Or you can take Olly or x64dbg and debug JITed x86 code instead. That's what I did. :-) Link to comment Share on other sites More sharing options...
GIV Posted August 5, 2016 Author Share Posted August 5, 2016 This method is reliable in large code functions/programs? Link to comment Share on other sites More sharing options...
GIV Posted August 5, 2016 Author Share Posted August 5, 2016 Here is a small modification. Can you keygen this? Algo is not complicated either. Simple Keygenme 2016 - giv.rar Link to comment Share on other sites More sharing options...
kao Posted August 5, 2016 Share Posted August 5, 2016 I'm "out of office" until Sunday night but I'll be happy to try it on Monday.. 2 Link to comment Share on other sites More sharing options...
Insid3Code Posted August 5, 2016 Share Posted August 5, 2016 2 hours ago, GIV said: Here is a small modification. Can you keygen this? Algo is not complicated either. Simple Keygenme 2016 - giv.rar Spoiler %Insid3Code 37731101151051005167111100101giv 2 Link to comment Share on other sites More sharing options...
RDGMax Posted August 5, 2016 Share Posted August 5, 2016 hmmmm .net security -10 Link to comment Share on other sites More sharing options...
GIV Posted August 5, 2016 Author Share Posted August 5, 2016 3 hours ago, Insid3Code said: Reveal hidden contents %Insid3Code 37731101151051005167111100101giv Write a keygen. Link to comment Share on other sites More sharing options...
Insid3Code Posted August 6, 2016 Share Posted August 6, 2016 Quote Write a keygen. Attached binary with source, it's only conversion (ASCII/Decimal) with an trick! keygen.rar 1 Link to comment Share on other sites More sharing options...
Ahmad_k Posted August 6, 2016 Share Posted August 6, 2016 Trying again with eazdevirt tool. it crashes. After debugging i found that newer version of eazfuscator uses Dup instead of Ldloc.0 as first instruction in the dictionary. so after changing this now eazdevirt can run. But now i got 0 methods devirtualized . On old challenge (Jan 2016) @Saneki noticed a change in VM's stream type and he updated eazdevirt source code but didn't release the new updated source. Link to comment Share on other sites More sharing options...
GIV Posted August 8, 2016 Author Share Posted August 8, 2016 (edited) On 06.08.2016 at 4:00 AM, Insid3Code said: Attached binary with source, it's only conversion (ASCII/Decimal) with an trick! keygen.rar Hi. You hardcoded a string before the name. Is a combination but the options are more than this hardcoded string. The original code was: If txtKey.Text.ToString.Substring(0, 1) = "3" And txtKey.Text.ToString.Substring(2, 1) = "7" Then txtKey.Text = "" txtKey.Enabled = False txtKey.Text = ":))" End If So first and third character from the serial which is the ASCII correspondent of the name characters must begin with 3 and 7. In this way if we look at the ASCII table the possibilities are much more that the hardcoded string. The keygen is not 100% correct regarding from this point of view. I.M.H.O. the correct way was, if the keygen generate random chars matching the required conditions before inserting the name you chose. Once you get the algo decrypted which is very simple and i consider the second keygenme solved. Do you want to change the algo to make harder challenges for this keygenme (maybe others have to learn something from it)? Edited August 8, 2016 by GIV Few spell changes. Link to comment Share on other sites More sharing options...
kao Posted August 8, 2016 Share Posted August 8, 2016 There's nothing wrong with Insid3Code's keygen and hardcoding few chars. It generates valid serials, that's all that matters. What would be the point of making more of the same? People who can get around Eazfuscator are bored by the crap algorithms. And people who can't get around Eazfuscator.. Well, they can use these 2 challenges to learn. Link to comment Share on other sites More sharing options...
GIV Posted August 8, 2016 Author Share Posted August 8, 2016 Yep. OK. More complicated algo for key verification would not be so easy (i think). Also the X64 keygenmes protected with Eazfuscator could be interesting enough. Anyway could someone put here the 2 files unpacked? Link to comment Share on other sites More sharing options...
kao Posted August 8, 2016 Share Posted August 8, 2016 x64 keygenme with Eazfuscator? Hmm, ok, let's try that.. Link to comment Share on other sites More sharing options...
GIV Posted August 11, 2016 Author Share Posted August 11, 2016 OK. Here is a X64 build. Simple Keygenme 2016 - giv.rar Link to comment Share on other sites More sharing options...
Ahmad_k Posted August 11, 2016 Share Posted August 11, 2016 There is a problem in the executable, i cannot run it properly. It closes immediately after putting any character in username field. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now