I am trying to reverse engineer a crackme exe. I have managed to find the function that checks serial number based on email input. So, 4 arguments are pushed to the stack (
esp) which are the input values and their lengths.
Illustration using IDA:
Stack view using OllyDbg after function gets called:
Of course, I am able to make the program show "Serial is valid" using either
Run to cursor command or setting
0x1. However, my the aim is to somehow extract the correct serial number from program. My digging into
sub_402B10 gave that neither the length of email nor serial can be greater than 255(correct me if said wrong),
but nothing further. I only see there some xor's shiftings in loops. So my question is how can the
sub_402B10 function can return a boolean value considering there is not any
strcmp-like function. Could someone provide useful information how the serial checking can be carried out by the program?
I know this post will be closed or put on hold as off-topic but I have spent my 4 days on going through every byte of
sub_402B10 and looking the changes in stack and registers. Please, at least, give a direction to me, I've ran out of keywords to search on google.
Here is the executable file. It has .txt format since google drive did't let me upload it otherwise.