I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID.

It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same hardware, same username, same Ethernet MAC addr, both offline (not connected to the outer world).

It shows 2 different UUIDs, unique to each of the machines.

I think that it checks for installation markers made by Windows installer.... Could be MountPoints, Cryptography seeds - something that is unique to every copy of Win.

Tried to trace it with ProcessMonitor (SysInternals), but after applying all filters and eyeballing 8000+ rows of the output, I couldn't find anything relevant.

What tools would you recommend for tracing any API hooks, or the way it enumerates/probes different parts of the system?

WinDBG and other debuggers are out of luck for me, I'm not really good at x86 assembly language yet...

NSA's Ghidra came up with a pile of gibberish because the program has some obfuscation/antidebugging. Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.