I like security as a hobby and I not so often I read and play with a few simple KeyGen games and I enjoy it.
Reversing and KeyGen is very interesting but I'm a beginner and my questions are probably very dumb but I will be very thankful if you could help me.
Until the moment I have reversed simple keygen applications using techniques such as:
- Look for string text reference to find the interesting code area.
- Keygen fishing.
- And bypass
Yeah, I know, really basic stuff. Here is a video similar to what I do in general:
Just for learning sometimes I try to reverse a few small and medium application that I buy for Windows and looks like simple products without many protections.
This is a software that I acquired 2 months ago and the whole installation is around 50MB. One of the motivations to try apply my basic knowledge here is because I like to see if what I learned in keygens really work in real-life, my experience that medium softwares are much harder since keygens are very small and easy to find the routines that you want. :)
** Just to make it very clear, I have a license for this program and my intention is only learn and increase my knowledge. Since I have no commercial intention in break it or create any damage I will not disclosure the application - I hope you understand. **
OK, let's go. The application consist of one main executable (~33MB), 6 DLLs (very small ones and some of them are
libeay32.dll, etc) and around 90
.xsd files (XML format). My first step was try to identify the programming language used and if a packer was present, please, see screen shots below:
It really appears to be developed in Delphi, with CFF I confirmed it. Also, there is no section that points for an packer looking at CFF information and EXE Information and RDG also say it's clean. However, RDG found
IsDebuggerPresent and pointed for an protection software as you may see. However, I'm not sure if it's a false-positive.
On my application the serial is entered in a field like that:
And once I enter a wrong serial number (30 chars long) I get a message like that:
I guess it's not a
MessageBox, or at least it's very custom one. For this kind of messages should I keep breakpoints at
MessageBoxA, etc? Or there is a different API?
Below is a screenshot once I attach to the application running:
When I press "run" at OllyDbg it's what I get:
Here is a list of SEH chain:
Here are the "Windows" available, including the one that I would like to disassemble, examine and put a breakpoint:
However it fails to debug, see below, please:
Is it some kind of protection? How to disable this part of code, put breakpoints, etc?
Looking at "Text String References" I'm able to see just partial messages and not the one displayed on my custom "
Also, There are many parts that looks like an message that will be completed on the fly, for example "A chave informata esta" which means "They key entered is" or "Chave incorrecta n" which means "Wrong key at".
Additionally, I noted that are parts of the application when some texts are not stored as a "TextString", instead I see "char by char" in sequence at OllyDbg creating a few strings (also not very useful to me).
If I define a breakpoint in any of these TextStrings it's what happen - an exception:
Is it a protection? Any idea how to bypass it?
From here the only thing that I'm able to do it pass control to the application and all is over. :(
Also, if I refuse to pass control to the application and I continue with F7/F8 I get something like that:
It ends with an instruction not recognized by OllyDbg. Any idea?
I also tried to set breakpoints in Names from
user32.dll such as
GetDlgItemTextW since I believe they are the APIs used to read my entered serial number. The strange thing is that they are exported and not imported as demonstrated below. Is it normal?
Once I created the breakpoint and stated stepping into I got this exception again and I was forced to pass control to application and game over again. :(
I was thinking it could be some basic Anti-debugging protections, so I enabled "aadp4olly" and "Olly Advanced" with many options but it was unable to solve the issues, so, I'm not so sure anymore about what is issue is.
All help and answers are very appreciated, but please, keep in mind that I'm a beginner.
** UPDATED **
Thanks for your answer, but it doesn't solve the whole issue. Please, see details below.
First I updated my PEid database from this link:
The following screenshot demonstrates PE details:
Here are details about PE sections:
Looks a bit strange for a not packed binary, right? But I can't figure out the correct packer.
Entropy and and Fast Check say "not packed", but EP check points as packed:
Here is the original EP found:
RDG Packer Detector pointed that Obsidium protection was present, however I guess it's a false positive. See the unpacker failing to recognize the format:
The unpacker is available here: http://down.52pojie.cn/Tools/Unpackers/
Also, the great Ferrit Anti-Anti-Debuggin script for OllyDB was not enough to allow me to debug it. Please, see below:
From here I'm forced to pass control to application and I lost control of if as demonstrated on my first post. I tried to freeze all threads and just keep the main thread running but it continues to fail.
Resource Hacker is unable to read Delphi resources:
Even Resource Hacker FX fails because it says a new version Delphi was used to compile.
Delphi Decompiler also failed. First I tried attach to my target:
Once the analysis finished it found the Classes Info:
But the important thing are the "Forms" and "Procedures" and nothing was found:
IDR (Interactive Delphi Reconstructor) also appears to be useless since the target application was compiled with Delphi 2011 or 2012 and no definition file is available for this version.
Thanks again for your help and effort.
** UPDATE **