I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?

  • Nearly any crackme is what you'd call "non-hardcoded" one. – NirIzr Jan 23 '18 at 1:17

It doesn't work like that, unfortunately. I'm going to be drastically oversimplifying the topic, but the 10,000-foot view is that you have two ways to reverse engineer:

Static Analysis: Studying a binary without running it. Programs like IDA can be used to disassemble a binary to automagically lay bare what it can of the binary's workings. This does A LOT for you if you know what you're looking at. Otherwise, prepare to be 100% overwhelmed. There's an amazing introduction to IDA on YouTube that you can watch here.

Dynamic Analysis: Studying the behavior of a binary while it's executing. This is when you use debuggers like OllyDbg, x64dbg, WinDbg, Cheat Engine, etc.

There are really complex things you can do via other applications/plugins/libraries/frameworks, but you tend to discover those during threads of research. There's likely a plugin or something out there for Olly that will profusely log events/tracing, but the reason what you're interested in won't really work is the amount of data you'd be logging would be insane. You'd still have to search through it all to make sense of everything. Consider there are registers, memory, on-disk, and off-site (which gets you into network protocol land).

For what you're interested in, there's a really, really good video tutorial that uses OllyDbg and IDA to reverse a crackme (video here). For a different approach for the same crackme via dynamic analysis, (here is a video) where I use Cheat Engine, which is an unorthodox tool for the job but that I think a beginner such as yourself would learn a lot from (there's memory scanning, patching, writing custom Assembly and creating a script, etc.). Full disclosure: the tutorial using Cheat Engine is from me.

You have a lot of learning ahead of you, but try to enjoy the ride!

  • Thanks for your answer! Yes, I was talking about dynamic analysis. Do you think that a logging script like this: github.com/deresz/funcap , which is for IDA Pro, can track the x86 registers values for a non-hardcoded generated key? What I'm trying to understand is "unique key generation" vs "generation of lots of compatible keys". And if a unique generated key can be tracked among the x86 registers values. – Tigre Jan 2 '18 at 21:56
  • The best answer I can give you is "maybe." Your hands are now dirty enough that you can dive in and see what you come up with. There's just a lot of nitty-gritty details on an individual binary basis where no generic answer can apply. If you're trying to reverse the algorithm used for a dynamically-generated key, then there's no telling what kind of algorithm you're dealing with. By all means, find an automated solution and churn your binary through it, but with what you're asking for, there's not a one-size-fits-all solution. Also, again, registers aren't the only thing to keep track of. – dsasmblr Jan 2 '18 at 22:36
  • I'm a total newbie. I just want to find a crackme to see an example of x86-register-value logging when the key is unique and generated, not hardcoded. – Tigre Jan 2 '18 at 23:42
  • Try inquiring on the Tuts4You forum. Someone there may be able to satisfy exactly what it is you're looking to achieve: forum.tuts4you.com – dsasmblr Jan 3 '18 at 1:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.