This function is imported from kernel32.dll. Lastly, at 40111D there is a call to lstrcmpA. Within the hook, we would store symbolic values representing the two parts of the unlock code into the ebx and edx registers. Since we are executing this function in isolation we need provide the inputs ourselves, and this can be done by setting a hook at 4010FF (set_ebx_edx). The unlock code which is comprised of two parts are passed as arguments to the function. We are going to execute the above function symbolically. If our entered unlock code is correct check would return 1 and we would go to the green color basic block at 401234 which displays the good boy message.įig 4: Inserting hooks inside the check function Okay we have already solved the crackme, so why another method? This is because I wanted to see if we can use angr for the same purpose, besides it would be a good learning experience.įig 3: We want to execute the green basic block and avoid the red oneĪt 40122A function check is called. These two bit vectors represents the two DWORDS of the unlock code. Part2 = ebx = BitVec( 'part2', 32)We declare two bit-vectors of with a size of 32 bits each. Here we are converting the that string to a list of characters where each character is represented by its ASCII value. Target = map(ord, list( '0how4zdy81jpe5xfu92kar6cgiq3lst7'))After encoding the installation id it must match with the hardcoded string. Install_id = getInstallIdFromString(sys.argv)Here we convert the install id into its proper form i.e the order of the two DWORDs within each QWORDs is reversed and returned as a list of integers. Lets' walk through the code step by step. The script takes in the installation id as a command line argument. Then we will use Z3 to solve the system and find the two dwords (unlock code) which encodes the installation id to the hardcoded string. Specifically, we will represent the encoding loop in Z3. At first we will try to model the system in Z3.

De4dot gui v1.0 english