 |
Figure 1: Application | |
After installing and enter the registry BP put a program in vbaStrcomp
when we are in the registration form and we can see that the comparison is made with the result of some mathematical operations in both the number we entered as the number generated by the program and not the numbers themselves.
#
HKEY_CURRENT_USER \\ Software \\ VB and VBA Program Settings \\ CF Developer Group \\ DocCF
#
and in my case that we are interested are:
Setting1 = 10838093996047972805767 10061210012438047703422
Setting3 =
We plot and we used the first two numbers Setting3 for 3 and then adding them FADDP 1 with the results of each operation can see you in ST0, ST1, ST2, ... in FPU Registers 
#
FSUBP 804.00000000000028730
ST = ST (1) = 999.00000000000057460
----------------------
---- 195 (score)
#
and the result is divided by 3:
FDIVP
# 195 / 3
--------- 65 / / is a first part of chain compared
#
Well and does not use images, only show you the operations performed in Setting3 chain. Then added with FADDP
#
4 + 13 -----
#
17 which is used to obtain the following substring 1006121001243804 770 3422 then multiplied
FUMLP
# 3 * 3 (the multiplier is the number of characters in the substring, in other cases it may be 4) -----
#
subtract 9 of the substring previously converted to an integer:
#
fsub
ST RESTA = 9.0000000000000028730ST (1) = 770.00000000000028730
------------------------
#
sum is then performed
#
FADDP
13 ---- 17 +4
3 +17 = 20 / / used to get the last substring.
#
1006121001243804770 3422
After passing a whole this is done the rest
#
FSUBP
3422-5997 ----------
2575 and the result is divided
FDIV
2575 DIVIDE / 5
-------- 515 / / get the last part of the string comparison
# 65761515
We have the transactions made from Setting3 and chain are compared. Analyzing
Setting1
After tracing a bit see you enter the value of which is the number setting1 we need to validate the software in my case is Setting1 = 10838093996047972805767 uses the first 2 numbers, passing over, you add 3 and 1 = 14 797 2805767 1083809399604
# 810-797 = 13 / 7 = 1, 85714285714286 / / This is the first part of the chain compared
#
After about sums yields the following substring 1083809399604797 2805 767 multiplies:
#
FUMLP (4 equals the number of characters that was taken from the original string)
4 * 9 = 36 then subtracted:
FSUBP
2805-36 = 2769 / / The second part that is concatenated to the string comparison.
#
After a sum is obtained last substring 10838093996047972805 767 which is subtracted:
#
FSUBP
4005-767 = 3238 / 3 = 1079.33333333333
#
And is UNICODE "1,8571428571428627691079,33333333333" which is compared as we saw at the beginning:
#
value that wrote the program: 10838093996047972805767
values \u200b\u200bthat change: Volume 2805767 1083809399604 768
the next 4 numbers (6 5 761 515) and they scored 36 remain in 5797 and replaces
who wrote the program Value: The value
10838093996047972805767 modified: 1083809399604768 5797 Volume 767
the last 3 numbers (65 761 515 ) multiplied by 3 and the rest of 4005 resulting in 2460 changed the previous values: Value
who wrote the program: 10838093996047972805767
values \u200b\u200bthat change: 2460 10838093996047685797 #
And we have our armed 108380939960476857972460 series ready for testing, and that we can make the keygen.
To test the string (in my case 65761515)
the program generates for the comparison I made a small program in c + + to demonstrate the analysis done.
#
# include # include
# include # include
iValor int (std:: string cad); std:: string sValor (int num);
std:: string leerValor REG_SZ (Registry HKEY, const std:: string & Sclavi , const std:: string & sValor);
cRetorno char * (const std:: string & sSource);
int main () {
std:: string sClaveReg = "Software \\ VB and VBA Program Settings \\ \\ CF Developer Group \\ DocCF;
std:: string sValorReg = "Setting3;
std:: string = sInfoRegistro leerValorREG_SZ (HKEY_CURRENT_USER, sClaveReg, sValorReg);
std:: string sResult =" ";
std:: string sNumeroBuscado = "";
/ / Assign to an integer the first 2 numbers iInicio
int = iValor (sInfoRegistro.substr (0.2). C_str ()) +3;
iResult int = 0;
/ / Assign a string 3 numbers from iInicio and converted to an integer
sResult = sInfoRegistro.substr (iInicio, 3);
iResult = (999 - iValor (sResult)) / 3;
/ / add the value of the 1st operation on string that will contain the searched number
sNumeroBuscado.append (sValor (iResult));
/ / process the next substring, assign a string, an integer and then perform the 2nd operation
/ / add the value of the 2nd operation on string that will contain the searched number
iInicio = iInicio + 3; sResult = sInfoRegistro.substr (iInicio, 3);
iResult = iValor (sResult) -9;
sNumeroBuscado.append (sValor (iResult));
/ / process the last substring, we assign a string, then an integer and perform the operation 3rd
/ / add the value of the 3rd operation to the string that will contain the searched number
iInicio = iInicio + 3;
sResult = sInfoRegistro.substr (iInicio, 4);
iResult = (5997 - iValor (sResult)) / 5;
sNumeroBuscado.append (sValor (iResult));
/ / Print the number sought to be compared with the results of setting1
std:: court \u0026lt;\u0026lt;sNumeroBuscado \u0026lt;\u0026lt;Std:: endl;
std:: cin.get (); return EXIT_SUCCESS;}
iValor int (std:: string cad) {int temp = atoi
(cad.c_str ());
return temp;}
std:: string sValor (int num) {
std:: string sTemp;
std:: stringstream ssTemp;
ssTemp \u0026lt;\u0026lt;num; ssTemp.str sTemp = (); return sTemp
;}
std:: string leerValor REG_SZ (Registry HKEY, const std:: string & Sclavos, const std:: string & sValor) {unsigned char
infoValor [1024];
infocadena char [1024];
std:: string sClaveLeida = "";
HKEY hKey;
LONG lStatus;
DWORD dwType;
DWORD dwSize;
dwType=REG_SZ;
dwSize=1023;
int i=0;
lStatus = RegOpenKeyEx(Registry,cRetorno(sClave),0,KEY_READ,&hKey);
if (lStatus == ERROR_SUCCESS)
{
lStatus = RegQueryValueEx(hKey,cRetorno(sValor), 0,&dwType, (LPBYTE)&infoValor, &dwSize);
if (lStatus == ERROR_SUCCESS)
{
for(i=0;infoValor[i]!=0 && infoValor[i]!=204;i++)
{
infocadena[i]=(char)infoValor[i]; Infocadena
} [i] = '\\ 0';
sClaveLeida.assign (infocadena)
RegCloseKey (hKey);
sClaveLeida return;}
} RegCloseKey (hKey);
return "Unable to get the value;}
char * cRetorno (const std:: string & sSource) {int
ITOTAL = strlen (sSource.c_str ());
char * temp = new char [ITOTAL +1];
strncpy_s ( temp, ITOTAL +1, sSource.c_str (), ITOTAL +1);
temp [ITOTAL] = '\\ 0';
return temp;}
#
Author:
43H4FH44H45H4CH49H56H45H
MySQL.com (also MySQL France, Italy, Japan, Germany, etc) Full Disclosure (Hacked) 
are vbaR8Str can use math to see where he gets the comparison values, draw a little can see that the values \u200b\u200bobtained 
We plot and we see that the sum of the first 2 numbers Setting3 (10) + 3 + 1 = 14 is used to obtain the next substring to read 3 characters from that number as in my case would be 804 7703422 1006121001243 which subtraction of 999 
There is more dependent variable date varies the number of characters read for multiplication and subtraction of the 2nd part of operations, as this tutorial is made for those who are interested in Reverse Engineering , not specified as to the TRAC will see what I mean and thus avoid some people get the serial valid only copying the tutorial and learned nothing. 
