http://www.cypressnet.com - Webpage.
In this tutorial (aimed at new or first time keygen makers), I'll take you through step-by-step the processes and stages I follow when making a key generator. The nature of making a keygen requires your complete understanding of the mechanism used by the program to compute your code. Without further ado launch LaunchPad (no pun intended) and select the Register option, 2 dialog boxes (Name & Registration Number) appear.
Insert your bogus details, I use CrackZ/12344321 most times, the first task is to locate the generating mechanism, you'll find that bpx GetWindowTextA serves you well (allow 2 breaks for both dialogs contents). As soon as you've returned to the caller of the 2nd break, slice to the meat of the protection by performing a memory search for your name.
s 30:0 l ffffffff 'CrackZ'
The first location will most likely be the one you are interested in (but note multiple instances if they exist), now breakpoint on the memory range. My name was found at cs:00741120 so my bpr looked as follows (you don't need to include the CS if its current, but I use it as good practise).
bpr 0167:00741120 00741120+5 rw
Just note the rw flags (read/write) and the +5 (that is 1 less than my names length). When you hit Ctrl+D you should find yourself at this code.
When this call returns you'll be back at address 00424925, here
commences the protection, trace very slowly with F10 (don't trace
any subfunctions just yet), just observe the 2 loops and the
final calculation before the call to wsprintfA at 004249BE.
Now lets work through slowly, the first loop uses all the letters
of the user name to generate a value (in my case 7F2h - 2034).
The next loop generates another value from the user name,
the arithmetic doesn't differ but the condition depending on the sign
flag is reversed, the result is (BB0h - 2992), the final result is
obtained using the first 2 results, the larger result - the smaller +
64h (i.e. 2992 - 2034 + 100 = 1058).
:004808A8 SCASB <-- Its a string length routine.
Lets slowly convert this into a full ASM key generator.
Stage 1 - Create an opening logo, prompt for the user name, and declare the program strings. If you are at all serious about coding more than 1 key generator in your lifetime you'll probably decide to use a standard template for this stage.
Stage 2 - Add some error handling, don't allow invalid user names (determine the min/max name length) 28 and 6 in this example, users will thank you for graceful exits to DOS.
Stage 3 - Chart how the program generates your code, think in terms of the functions you will need to code. Determine how the program handles numbers and space (20h) characters. Keep an uppercasing routine in your store of regular code snippets.
Stage 4 - Code in stages and debug each to destruction, its easier to find run-time errors when your examing specific areas of the source code, debugging your 100k masterpiece at the end is NOT a good idea. Remember that comments aren't the sole domain of high-level languages :).
Stage 5 - Add the output routine + necessary conversion routines. These should be fairly generic.
Specific tips include using 16-bit registers if at all possible, certain maths operations such as MUL can be optimised using SHL/SHR. Some MOV's can be optimised by PUSH src, POP dest instructions. Saving values on the stack as opposed to using memory areas is also a smart move.
LaunchPad v2.87 ASM Key Generator
Return to Main Index, New Reversers.
ourier New,Courier">:00491A8B 0FBE0A