Test Eax Eax Serial Key With The

S switches to protected mode with 32 -bit addresses Prefix 0 x 66 gets you 32 -bit: MOVW 0 x 66 MOVW.

So the next step in our algorithm is to multiply our previous sum by 1337.

Today Ill tell how I was making a keygen for a simple crackme program.

JNZ is an operator of conditional jump to some part of code if zero flag Z is not set.

This flag is usually set by some comparisons that will be done before JNZ.

So, TEST EAX, EAX.

This is something that should set our flag Z.

To make a jump to our string we need here flag Z to be set to 0 (so it means that Z flag is not set).

From googling I found out that TEST EAX, EAX sets Z flag only in case if EAX is equal to 0.

The result of the comparison is written into the EAX register.

So lstrcmpA will write 0 into EAX only if both strings are equal.

Test Eax Eax Serial Key With The

So this is the place where we compare provided serial key with the necessary one.

And we also see that String1 and String2 parameters are passed into this function through EDX and ECX registers.

And a little bit above that youll find a code that verifies length of the entered serial key is longer then 4 symbols.

The jump that goes over this part code is here: 0040108C JG SHORT Crackme2.004010AE And it goes here: 004010AE XOR ECX,ECX Put a breakpoint here (F2).

Now we are at the 004010B0 TEST EAX,EAX Take a look at the registers information (right upper corner of the OllyDbg).

After several runs I noticed that here EAX contains length of the entered serial key.

We know, that TEST EAX, EAX sets 0 flag only if EAX contains 0.

As length of the entered serial key is longer than 0 code will not do this jump: 004010B2 JL SHORT Crackme2.004010C0 Lets continue to run debugging by F8.

Now we are here: 004010B4 MOVSX EDX,BYTE PTR ESPECX8 Take a look at registers info.

This line will write into EDX one byte from address saved in ESPECX8.

That will be first letter of our name.

Press F8. We are now here: 004010B9 ADD EDI,EDX Pay attention that EDI is set to 0 now.

EDX contains ASCII code of the first letter in our name in hexadecimal format.

Run further until you are here: 004010BB INC ECX 004010BC CMP ECX,EAX INC command increases value of the ECX register by 1.

So far we know that algorithm of the serial key is the sum of all ASCII codes of letters in your name.

Lets continue to run program until we are here: 004010C0 IMUL EDI,EDI,539 This command multiplies value of the EDI register to 0x539 (this is 1337 in decimal).