Return to Revisions

As i commmented vb has its own set of functions
the fuction you have to look for in the 3rd crackme are
rtcMidCharVar()
vbastrvarval() ,
rtcAnsiValueBstr()
_vbavarmul()

the algo loops over the name characters
adds a constant to each
multiplies the result with another variable
and adds up all of them that is your serial
if you give the right serial you get a msgbox with password axxxxxxo

a simple keygen in powershell can look like

 $b =0;$a = SOMECONSTANT;@('d','u','g','g') | % { $c= (([int][char]$_ + SOMEOTHERCONSTANT) * AVARIABLE);($b+=$c) };$b

edit ,

vb does not use registers mostly

it uses a VARIANT structure for almost all functions and uses stack

if you use windbg you can take a look at the structure with

dt ole32!VARIANT

basically it is a ten byte long structure consisting of an union

0:000> dt -v ole32!Variant
struct tagVARIANT, 50 elements, 0x10 bytes  

the first member vt (SHORT int2b) indicates the variant type
(find Wtypes.h and look for

enum VARENUM
    {
        VT_EMPTY    = 0,
        VT_NULL = 1,
        VT_I2   = 2,
        VT_I4   = 3,

the next 3 SHORTS are reserved
the value at 0x08 is to deciphered based on the value of vt member
the member at 0x0c is pRecInfo
the member at 0x10 is tagDec an array

now that part is clear the function __vbaVarMul Takes three Arguments of type VARIANT

the first is the result the second is multiplier the third is multiplicand

here is a redacted windbg output for char 'd'

0:000> ? poi(@esp)
Evaluate expression: 1241928 = 0012f348
0:000> ? poi(@esp+4)
Evaluate expression: 1241944 = 0012f358
0:000> ? poi(@esp+8)
Evaluate expression: 1241880 = 0012f318
0:000> dt ole32!Variant vt poi(@esp)
   +0x000 vt : 0  <---- vb NULL / v_EMPTY
0:000> dt ole32!Variant vt poi(@esp+4)
   +0x000 vt : 3 <-------vbLong 
0:000> dt ole32!Variant vt poi(@esp+8)
   +0x000 vt : 2  <-----vbInt

0:000> .enable_long_status 1

0:000> dt ole32!Variant lVal poi(@esp)
   +0x008 lVal : 0x12f3f0
0:000> dt ole32!Variant lVal poi(@esp+4)
   +0x008 lVal : 0xxx
0:000> dt ole32!Variant lVal poi(@esp+8)
   +0x008 lVal : 0xxxx
0:000> ? 'd' + xxx
Evaluate expression: xxxx = 00000xxx