How does serial number is checked in this crackme?

Question

I am trying to reverse engineer a crackme exe. I have managed to find the function that checks serial number based on email input. So, 4 arguments are pushed to the stack (esp) which are the input values and their lengths.

Illustration using IDA:

Stack view using OllyDbg after function gets called:

Of course, I am able to make the program show "Serial is valid" using either Run to cursor command or setting al to 0x1. However, my the aim is to somehow extract the correct serial number from program. My digging into sub_402B10 gave that neither the length of email nor serial can be greater than 255(correct me if said wrong),

but nothing further. I only see there some xor's shiftings in loops. So my question is how can the sub_402B10 function can return a boolean value considering there is not any strcmp-like function. Could someone provide useful information how the serial checking can be carried out by the program?

I know this post will be closed or put on hold as off-topic but I have spent my 4 days on going through every byte of sub_402B10 and looking the changes in stack and registers. Please, at least, give a direction to me, I've ran out of keywords to search on google.

Here is the executable file. It has .txt format since google drive did't let me upload it otherwise.

Answer 1

To summarize your current effort: So you have accomplished to find WHERE the magic is happening. But you didn't DEMYSTIFY the magic itself.

In detail, you shouldn't expect a simple strcmp-like serial checking method. If you step back for a second, you will probably realize that a simple strcmp-like comparison would be far too easy, right? This is probably only the case in some basic tutorials like this one.

To cite your question:

So my question is how can the sub_402B10 function can return a boolean value considering there is not any strcmp-like function.

That is exactly what is your job, so you have to understand all the xor, shift and loop magic and how it generates the final 0x1 output.

So you have two choices to proceed:

1. You can dive into the function and demystify it. What is actually the job of solving a keygenme task.
2. You can reformulate a second question, whith additionally insights of the sub_402B10 routine. But be careful, you should show that you have already invested some time and formulate concrete questions to the proceeding of the routine itself. If not, the question will probably be closed as a "homework" question.

Perhaps you should take a look at some tutorials, to get a feeling of cracking a keygenme: Infosec.

Hope this helps and points you in the right direction!