2

I'm trying to bypass (crack) a very old software that require license in order to unlock all the features

i was digging in the lines with a little bit of knowledge in assembly and i found the line where it compare the hash of the request code with the hash of the license i entered

this is the line ( not %100 sure ) enter image description here

arrow1 where the random request code generated and the entered license saved to a param (not sure)

arrow2 where the compare happen ( same not sure)

The software compare a hash with the hash of the key code you entered, if it's the same, it will work

a random license request code generated everytime you run the .exe

using GenerateRandomNumber

enter image description here

and hashed by using HkdfHashAlgorithm

enter image description here

my question is

when i change je 0x7C1AEF1F to jne 0x7C1AEF1F

enter image description here

the software stopped working and when i execute it i got the command prompt for 1second and disappear

enter image description here

so what i need to change in order to compare the hash of the request code with the same hash or to say if not equal so activated...

Appreciate any help

2

Algorithm: ((Licence request code) + 0x26946948) ^ (your serial number of C: volume or 0xffffffff if failed).

  • This keygen I'm written in golang.

  • Or javascript keygen function keygen(code, serial) { code = parseInt(/([0-9-]{12})/.exec(code)[0].replace(/-/g, '')) return ((code + 0x26946948) ^ parseInt(serial.replace(/-/g, ''), 16)) >>> 0 } // example // '9950-7444-3132-b9' is Licence request code // 'A639-6EDE' is Volume Serial Number of C: keygen('9950-7444-3132-b9', 'A639-6EDE')

serial

  • Or modify assembly at file.exe+178A je file.exe+17B4 -> jne file.exe+17B4 to bypass.
7
  • Thank you for your answer, please how can i use that keygen? and where i find SpoolManager.exe+17B4 ? – JDEV Dec 20 '19 at 4:59
  • @JDEV, see my edit to usage javascript keygen :D – xax Dec 20 '19 at 5:06
  • Man, i don't know how you did it, it's working, i really don't understand how you figure it out, please if you have time, explain it, i'm very interested / i spent more than 10 hours digging in assembly lines without success, for me your code looks like a magic, haha, Thank you very much i really appreciate it – JDEV Dec 20 '19 at 5:29
  • How can i find SpoolManager.exe+17B4 in x64dbg please ? – JDEV Dec 20 '19 at 10:07
  • I'm using Cheat Engine to debug this program, SpoolManager.exe+17B4 = 00400000 + 17B4 = 004017B4 – xax Dec 20 '19 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.