Hello!
Welcome back.
In our next project, we are going to try this crackme by trope, and this is the credit I give to the
author.
We are going to learn a fast way to do fishing by toggling the zero flag, and I will explain to you
as we go along.
So please download this
crackme from the resource section for this lecture.
After unzipping it, the unzip password is crackinglessons.com.
After unzipping it you will find two files in there.
So first scan it with DetectItEasy and you will find that it is a 32-bit program.
So you need to use x32dbg.
Let us first run it and see what it does.
So that's a Windows GUI.
It asks you to enter your password.
We enter 1234567, eight and nine.
And we click check and it says incorrect password.
So now we can use the string search method by looking for this string "incorrect password."
So remember the string you are looking for: incorrect password.
And now we are going to open the program.
And right-click and go down.
Search for current module's string references.
And here you can see incorrect password is there.
You can double-click and go to that address.
Incorrect password.
Now you can scroll up and scroll down.
And you can see there is a good message down here.
"You did it."
And then scroll up further.
You can see there is GetDlgItemText.
GetDlgItemText is to read in the text box, the password that you type in into the text box.
So immediately after that we can put our graph here. Right-click and graph.
And if you scroll down you can see the logic.
So after reading in the text it does all this, these instructions.
And then it either goes to the left for the incorrect message, or go to the right, presumably
for the correct message, the congratulatory message.
And then down here you can see there are some strings being loaded and compared: R and then E and then
D, so you can more or less guess that this is the correct password.
But we don't want to do that way.
We want to use the tracing method so that you can learn some new techniques.
All right.
So let's put a breakpoint here and get started.
And then we turn the tracing highlighting on.
And now we run and then we will enter our password.
We will enter 123456789.
Click on check and it hits our breakpoint.
Now we start tracing by stepping over until we come to this compare here.
So at this point it is comparing 52 in hex with your byte,
the first byte of -, the first byte of - is one.
Because you can see byte here.
That's how I know it is the first byte.
So we can click on this and you can see the parameters here.
So it's comparing one with R. One is your first character of your serial key, the password that you entered.
That means it is expecting R as the first character.
But you entered one.
So that suggests that the first character of the password is R.
Now because we did not enter R, when you go to the next line, it's going to jump. Jump's taken.
So the jump will cause it to come over here and show the bad message.
So
we can now let it jump here, restart the program and enter the correct password R as the first character.
But in order to make it faster, we can do something else instead of letting it jump here and
then restart it and re-entering the first character as R, as a correct password, we can prevent
the jump and let it go straight and see what is the next thing it is doing.
So in order to prevent this jump from taking, we can toggle the flag.
This is called the zero flag.
So the zero flag controls whether the jump will happen or not.
So currently it is going to jump.
If we don't want to jump, all we need to do is come here and double-click.
Double-click on this.
And now it is red.
And now if we click on this you will see jump is not taken.
So we can now go straight.
That means we have assumed that this comparison succeeds, that we have correctly entered
R.
So now we want to go to the next instruction where it is now going to compare two with E.
So in this case it is comparing 45 hex. 45 hex is the character E, and it is comparing that with the
- plus one.
- plus one is the second character of our password, which is two.
The first character is -, - plus zero, second character is - plus one, third character is -
plus two, and so on.
So this is an offset into the array.
This is actually an array.
So now since we entered the two, it is the wrong character.
It is expecting E.
So that suggests that our second character should be E.
And then step over, but you will see that it is going to jump because click on this, you will see
that it's going to jump to the bad message because we did not enter E.
So again, we don't want to let it jump and restart the program and enter the first two characters as
R and E.
We want to save some time so we can use this trick.
Toggle the zero flag again so we toggle the zero flag.
Now you will see that we click on
this, jump is not taken.
See that.
So it's going to go straight.
So let it go straight.
And this time it's going to compare the hex 44 with the - plus two.
- plus two is the third character of our password.
So if you click on this you can see here it is comparing our third character which is three
with the character D.
That means our third character should be D.
So we have fished out D.
So this is what I mean by let's step over by toggling the zero flag.
You see.
So now because we did not enter the correct password D, it's going to jump. Can see jump is taken.
But again toggle the zero flag so that it doesn't have to jump.
We assume that all the other three earlier ones were correct: R, E, D.
So this prevents us from jumping and we can now go straight.
Step over to go straight and we can now check.
Now it is comparing for the character four with S.
So the fourth character is supposed to be S.
So we now fished out the fourth character S.
And again we step over and we can see that it's going to jump again.
We toggle the zero flag.
Don't allow it to jump.
Let it go straight because we want to save some time.
We can now check what is
the next thing is comparing.
It's comparing the fifth character with 4F. 4F is our fifth character of a password and it is expecting,
O, that suggests that O capital O is the fifth character of our password.
Then we step over, click on this.
It's going to jump again.
Do the same trick.
Toggle the flag, let it go straight.
And now it's going to compare six character with X.
That means the sixth character is X.
And then go here.
And then again we click on this.
It's going to jump.
It's going to jump to the bad message.
So by now we know that he has finished comparing and is about to show the bad message.
So we have managed to fish out the correct serial key: REDSOX.
All right.
So let us now stop this program and test it out.
Just click on this directly and key in REDSOX in caps.
Click check and see "You did it."
So we have solved it.
So we have managed to fish it out using the fast fishing method by toggling zero flags.
Okay, so that's all for this video.
So next one we are going to see how to patch the thing to always show the good message.
So try that before you watch the next video.
See you then.
Thank you for watching.