. Published by +Tsehp feb 2001

Well, Mercution please jump up and down right now, finally I'm are using the Hellforge macro but i have done come changes at it ;) (CRIES)

I was bores at school so I went online and I founded alotta cool things at the net, like http://www.sex.com and http://www.disney.com and those pages just roxx!!

I have wondered how DeDe are working in a long time so now i started again to work with it, I had no clue on wha tthe hell I was doing but I read and followed the instructions and tested out.... I have founded out many things already so that is great....

And now we are going to work coz we will crack Crackme 1 and Crackme 1.B
 

Cracking Crackme 1.0

Before we are starting so have to to understand what the hell this crackme are doing... Run the crackme and you will only find one edit field to enter your code into. I tried to fill in "2951" and i clicked the Try button and I ended up with one stupid NAG that told me "INCORRECT PASSWORD" Well.. Here are our options

1. We can patch the damm jump that jumps to the NAG
2. We can patch the nag so we won't get any stupid NAG's up 
3. We can leave the crackme alone and burn our PC and begin with fotball instead of cracking
4. We can find the correct serial

Now, i'm are abit tierd of patching the jumps and calls for removing stuff so option 1 and 2 are not accepted.
Option 3 are also now accepted coz i'm are one PC holic :)
Option 4 will work fine for me... 

Let's begin witht he work so just follow the steps.

1. Open DeDe
2. Open File and select dcm10.exe
3. Click on the Process Button and now DeDe are disassembeling the crackme
4. Follow the instruction under the Disassembeling
5. Goto the procedures tab in DeDe
6. Select TForm1 and Button1Click 

I'm are only guessing at step 6 but it was was the correct guess too as you can see so are one new window poping up now and it have some disassembely code for you. How I knew that was because that I scrolled down and founded my error message:

00442225   E81A19FCFF             call    00403B44      <-- Serial Compare Routine
0044222A   750C                   jnz     00442238      <-- The Bad jump if the serial are wrong   

* Possible String Reference to: 'PASSWORD IS CORRECT'    <-- Here is our good message
|
0044222C   B888224400             mov     eax, $00442288

* Reference to: Dialogs.ShowMessage(System.AnsiString)
|
00442231   E88EF9FFFF             call    00441BC4
00442236   EB0A                   jmp     00442242

* Possible String Reference to: 'INCORRECT PASSWORD'    <-- The bad message that we don't want to see
|
00442238   B8A4224400             mov     eax, $004422A4

Now, try to scroll up and you will see this and here are also our little serial :)

* Reference to: Controls.TControl.GetText()    
|
0044220D   E8D20FFEFF             call    004231E4        <-- Here it takes the serial that we entred
00442212   8D45F8                 lea     eax, [ebp-$08]  <-- Stores the entred serial into EAX

* Possible String Reference to: 'ASSHOLEKING'
|
00442215   BA74224400             mov     edx, $00442274  <-- Stores the string ASSHOLEKING in EDX

* Reference to: System..LStrLAsg()
|
0044221A   E83116FCFF             call    00403850
0044221F   8B45FC                 mov     eax, [ebp-$04]
00442222   8B55F8                 mov     edx, [ebp-$08]

* Reference to: System..LStrCmp()
|
00442225   E81A19FCFF             call    00403B44        <-- Compare Routine
0044222A   750C                   jnz     00442238        <-- IF EAX == EAX then don't jump else jump to the bad message

* Possible String Reference to: 'PASSWORD IS CORRECT'      <-- Good message
|
0044222C   B888224400             mov     eax, $00442288   <-- Good message stored in EAX

* Reference to: Dialogs.ShowMessage(System.AnsiString)
|
00442231   E88EF9FFFF             call    00441BC4        <-- Shows the good MessageBox
00442236   EB0A                   jmp     00442242        <-- Jump over the Bad Message

* Possible String Reference to: 'INCORRECT PASSWORD'      <-- Bad Message
|
00442238   B8A4224400             mov     eax, $004422A4  <-- Bad Message stored in EAX

Only for looking so have I founded the famous CMP function int he call at 00442225 and that call worked too, trace into it by dubbleclick at it and you will see this.. (I have only taked the important codes)

00403B44   53                     push    ebx
00403B45   56                     push    esi
00403B46   57                     push    edi
00403B47   89C6                   mov     esi, eax    <-- EAX == Our entred serial
00403B49   89D7                   mov     edi, edx    <-- EDX == The correct serial
00403B4B   39D0                   cmp     eax, edx    <-- Compares the entred serial with the correct serial

And now you now whare it was :) I tested ASSHOLEKING and it worked 150% fine for me... 

---

Cracking Crackme 1.B

Again,,before we are starting so have to to understand what the hell this crackme are doing... Run the crackme and you will only find one edit field to enter your code into. I tried to fill in "2951" and i clicked the Try button and I ended up with one stupid NAG that told me "PASSWORD IS WRONG"

We will follow the same stepas as we did with Crackme 1.0 

1. Open DeDe
2. Open File and select dcm1b.exe
3. Click on the Process Button and now DeDe are disassembeling the crackme
4. Follow the instruction under the Disassembeling
5. Goto the procedures tab in DeDe
6. Select TForm1 and Button1Click  

Dubbleclick at Button1Click and I didn't say in in Crackme1.0 that all code that you can find here is everything that 2Sweet have made under the Button1, there is nothing else that this code and nothing else.. THIS IS IT !!!! 

I founded this code

* Reference to control TForm1.Edit1 : TEdit                <-- Sets the focus at the SerialBox
|
00442207   8B83C4020000           mov     eax, [ebx+$02C4] <-- Will store it in EAX

* Reference to: Controls.TControl.GetText()                <-- GetText 
|
0044220D   E8D20FFEFF             call    004231E4         <-- Here it takes out our Serial (GetText)
00442212   8D45F8                 lea     eax, [ebp-$08]   <-- and stores our serial in EAX

* Possible String Reference to: 'PORNQUEEN'                <-- One Ppedefined string
|
00442215   BA7C224400             mov     edx, $0044227C   <--Stores the string PORNQUEEN in EDX

* Reference to: System..LStrLAsg()
|
0044221A   E83116FCFF             call    00403850
0044221F   8B45FC                 mov     eax, [ebp-$04]
00442222   8B55F8                 mov     edx, [ebp-$08]

* Reference to: System..LStrCmp()                          <-- StrCmp == StringCompare
|
00442225   E81A19FCFF             call    00403B44         <-- The compare routine is in this call
0044222A   750A                   jnz     00442236         <-- IF wrong serial then jump to the bad message 

* Possible String Reference to: 'CRACKED ;) !!'             <-- Good message
|
0044222C   B890224400             mov     eax, $00442290    <-- Stores CRACKED ;) !! in EAX

* Reference to: Dialogs.ShowMessage(System.AnsiString)
|
00442231   E88EF9FFFF             call    00441BC4          <-- Shows the good message
00442236   8B45FC                 mov     eax, [ebp-$04]    <-- The Message format
00442239   8B55F8                 mov     edx, [ebp-$08]    <-- The Message format

* Reference to: System..LStrCmp()                            <-- This is confusing
|
0044223C   E80319FCFF             call    00403B44           <-- But nothing important
00442241   740A                   jz      0044224D           <-- but what the hell is this ?? 

* Possible String Reference to: 'PASSWORD IS WRONG'          <-- The bad message string
|
00442243   B8A8224400             mov     eax, $004422A8     <-- Stores the bad message in EAX

This crackme is just the same as Crackme 1.0 but it have something new in the end, look at the last comapre routine at 44223C, trace into it and you will see the same thing that you was in the first crackme, CMP EAX,EDX where EAX == our serial and EDX == correct serial.. Nothing new in there but take a look at loaction 44222A and 442241

44222A == JNZ == Jump if Not Zero
442241 == JZ == Jump if Zero 

As you can see so are it taking the same coparing routing but only changed something, then jumps, I don't now how and WHY but this crackme are cracked now.... I have my serial wich are PORNQUEEN :))

Final Thoughts

 

Well, finally I now something about DeDe but these crackmes were easy, but it were good crackmes for beginning to learn DeDe and it's functions :