A Basic KeyGenMe Tutorial

--------------------------------------------------------------------------Materials: OllyDbg -

Code:

http://www.ollydbg.de/

KeyGenMe -

Code:

http://crackmes.de/users/hexic/crack_me/download/

An actual desire to learn Alright. In this paper, I'm going to guide you in learning the serial algorithm for the crackmes.de challenge by HEXiC. Although a real-world application may not use such a simple process, this is excellent for beginners in the reverse engineering field. I will not code a key generator ("keygen") for you, but you should hopefully be able to with the information learned by the end of this tutorial. First, let's open the application up in OllyDbg. There are other programs available, but this is the most popular. Press F9 to run the executable until a window prompts us for a name and serial key. I will be using the name 'sToRm' for this example. Fill the serial field with some zeros just as a placeholder. Now, I have done some prior analysis of the assembly in this application and have determined that the validity of the serial is checked through the CALL KeyGenMe.00401262 at address 0040116F. Place a breakpoint here, and when you click 'Check,' it will pause on that line. Now, press F7 to step into the call. Just a side note, let's search the binary for all text strings and record a few select ones, as this will become important soon. Right-click in OllyDbg, and select 'All referenced text strings' from the 'Search for' submenu. You should see our inputted serial and name (twice, actually). Take note of the addresses: 004010C1 004010D7 004010F9 PUSH KeyGenMe.00403254 PUSH KeyGenMe.004032A4 PUSH KeyGenMe.00403254 ASCII "sToRm" ASCII "00000000000000" ASCII "sToRm"

Step down the code until you reach: 0040126F |. A0 54324000 MOV AL,BYTE PTR DS:[403254]

In this line, the binary is taking the value of the byte at address 00403254 (hey, look familiar?) and storing it to AL. If you look in your 'Hex dump' window and hop to that address, you can clearly see the inputted name. So, 00403254 is the first character of the name (73 or 's'). The next line divides our value by 10, leaving the 3 after the decimal point to be stored in AH. EDX also picks up 00000003 on the following line. The next line uses the EDX value of 3 to add to the address 00403235, essentially pulling a value from the charset of the serial number. 00403235 holds 34, which is converted to ASCII '4' and stored to AL. Therefore, the first character of our serial is 4. 00401278 0040127E 00401284 00401286 |. |. |. |. 8A82 35324000 8A15 A4324000 38D0 0F85 E8000000 MOV MOV CMP JNZ AL,BYTE PTR DS:[EDX+403235] DL,BYTE PTR DS:[4032A4] AL,DL KeyGenMe.00401374

The next line does the same as the previous, but it is hard-coded to pull

the first character of our inputted serial at 004032A4 and assign to DL. Comparing AL (4) to DL (0), we JMP to the end of the CALL to return to the badboy. Restart the execution using Ctrl+F2, and follow the same steps as before, only starting the serial with 4 this time. Now, we safely pass by the check of the first character of the serial and move onto the second. This is exactly like before, but notice how the commands now grab their values but one byte ahead: 0040128E 00401293 00401295 00401297 0040129D |. |. |. |. |. A0 55324000 F6F1 8AD4 8A82 35324000 8A15 A5324000 MOV DIV MOV MOV MOV AL,BYTE PTR DS:[403255] CL DL,AH AL,BYTE PTR DS:[EDX+403235] DL,BYTE PTR DS:[4032A5]

See the logic here? If you don't, I suggest you reread the explanation of the first part or just go outside and make friends (lol). Anyways, we see that the 2nd character of the valid serial for name 'sToRm' is 'T'. 004012AB 004012B0 |. |. A0 A6324000 2C 2D MOV AL,BYTE PTR DS:[4032A6] SUB AL,2D

These two lines are incredibly simple. 2D in hex is a hyphen ('-'), so we now have the third character of our serial and the completion of the first section of it. On to the next part! 004012B8 004012BA 004012BC 004012BE 004012C4 004012C6 004012C8 004012CA 004012CB |. 33D2 |. 33C0 |> /33C9 |. |8A8A 54324000 |. |0AC9 |. |74 05 |. |03C1 |. |42 |.^\EB EF XOR EDX,EDX XOR EAX,EAX /XOR ECX,ECX |MOV CL,BYTE PTR DS:[EDX+403254] |OR CL,CL |JE SHORT KeyGenMe.004012CD |ADD EAX,ECX |INC EDX \JMP SHORT KeyGenMe.004012BC

You may pass over this loop at first, thinking "oh, it's just doing something with the name" and skip over it, but this loop is also important. It's actually going to give us the next eight characters of our serial! After resetting EAX and EDX (which will be the counter for this loop), we enter it. And now we see this damn 00403254 address coming up again! EDX equals 0 at this moment, so it will store the value of 00403254 to CL (and soon ECX; watch the registers on the right). We skip the JMP out of the loop until we run out of characters in our name to load. The hex of the 's' in 'sToRm' is added to the empty EAX, EDX is incremented by 1, ECX is reset, and we start the loop over again, this time pulling the second value of our name. If you're lazy, you'll see that the value of EAX (our full name) at the end of the loop is 1F5. This could have also been easily calculated with a calculator set to hex (hey, calc.exe!). 000001F5 is pushed onto the stack, some formatting is done, and then we are quickly thrusted into another loop. 004012E2 004012E4 004012EA 004012F0 004012F2 004012F4 004012F5 004012F8 |. /EB 11 |> |8A81 C0324000 |. |8A91 A7324000 |. |38D0 |. |75 06 |. |41 |> \83F9 08 |.^ 75 EA JMP SHORT KeyGenMe.004012F5 /MOV AL,BYTE PTR DS:[ECX+4032C0] |MOV DL,BYTE PTR DS:[ECX+4032A7] |CMP AL,DL |JNZ SHORT KeyGenMe.004012FA |INC ECX CMP ECX,8 \JNZ SHORT KeyGenMe.004012E4

ECX is now the counter, and the inputted serial is being checked against the hex value of our name we just determined. Don't see it? You may need to squint a little. The first five digits of our name value are zeros, because 1F5 in hex is really 000001F5 (eight characters). The ECX counter will increment until it equals 8, where it will then JMP out of the loop to avoid pulling and comparing values that aren't part of the hexidecimal portion of the serial. Therefore, our serial is now '4T-000001F5'. We're getting closer. :) Reset the execution, and return past this loop with our newly-found piece. Once again, the next lines call for a hyphen, or else we will be JMP'd to the badboy. Add it to the serial, and proceed once again. 0040130A 0040130C 00401311 00401317 0040131D 0040131F 00401321 00401327 0040132D 0040132F |. |. |. |. |. |. |. |. |. |. 33C0 B9 10000000 8B1D B8324000 8A83 52324000 F6F1 8AD4 8A82 35324000 8A15 B0324000 38D0 75 43 XOR MOV MOV MOV DIV MOV MOV MOV CMP JNZ EAX,EAX ECX,10 EBX,DWORD PTR DS:[4032B8] AL,BYTE PTR DS:[EBX+403252] CL DL,AH AL,BYTE PTR DS:[EDX+403235] DL,BYTE PTR DS:[4032B0] AL,DL SHORT KeyGenMe.00401374

Look somewhat familiar? These lines are near-identical to the ones that determined the first character of our serial. Follow in the 'Hex dump' to the addresses that are requested, and you will find that it is now sending the 1st-tolast character of our name through the division algorithm. For instance, EBX equals 5, so the value of 00403257 is ASCII 'R' (or 52 in hex). Can you figure out why EBX equals 5 in the first place? Anyways, divide the value by 10, and we are found with the fact that our next character in the serial must be a 'G', because it produces a hex value of 47. Follow this procedure again for the next (and last character) in the inputted name, and a 9 is produced. Now, we have a serial of '4T-000001F5-G9' for name 'sToRm'. Reset the execution (as if you haven't done it enough), and then run it with our credentials. Voila! You've just reverse engineered this algorithm. If you really want to make sure you understand the concepts behind this crackme, then try the entire process over again with a different name. If you wish to master it, then code a keygen with the information you've learned about it. ;) Cheers! sToRm

Backdoor possibility by DDos attack

Well I figure out this when I did read it from wikipedia.

Anywayes, take a close look to this, and tell me what kind of possibility it could have to sneak a backdoor on the Ddos attack.


First of all here we have something you should know about the denail of service (DOS), well the Denail of service has a very good access point for all us who wants to create a remote connection by use this shell .

if you are doing this and you got a Ddos program, then you can just place a keylogger + backdoor, so you can alwayes connect to the victim & see what's the victim are typing. Before you are make a attack, you will altso have to ping the victim, to see if his host computer is online, and if you see its online, then you have a good choise to get him owned !



This is how the dos attack looks like, and you can easily bypass the firewall since you are use denail of service, but anywayes you can read more about it down under this text.



Firewalls
Firewalls have simple rules such as to allow or deny protocols, ports or IP addresses. Some DoS attacks are too complex for today's firewalls, e.g. if there is an attack on port 80 (web service), firewalls cannot prevent that attack because they cannot distinguish good traffic from DoS attack traffic. Additionally, firewalls are too deep in the network hierarchy. Routers may be affected even before the firewall gets the traffic. Nonetheless, firewalls can effectively prevent users from launching simple flooding type attacks from machines behind the firewall.
Modern stateful firewalls like Check Point FW1 NGX and Cisco PIX have a built-in capability to differentiate good traffic from DoS attack traffic. This capability is known as a "Defender", as it confirms TCP connections are valid before proxying TCP packets to service networks (including border routers). A similar ability is present in OpenBSD's pF, which is available for other BSDs as well. In that context, it is called "synproxy".


Alright, here you get a complete view of how the denail of service attack bypass the firewall




Well if you wanna know more, or even like my post I could write more about this for sure .

But for now I'm just waiting for response and to look what people are think about my new thread,

I'm out

How to get serial key/crack/keyzen/patch for all most all softwares

now the below format explains you to
find serial key/crack/keyzen/patch for all most all softwares,cracks,serials,etc
and
helps you learn
how to find serial,serial key/crack/keyzen/patch,how to get serial key/crack for,easy way to get crack effectively

Most of the people downloading trial and using it, only after the expiration of trial they try for crack, Serial No, Keygen, Patch....

many of them don't know where to get Serial No, Some websites may infect your system with Trojan horse, Viruses, Ad ware, Spy ware....

So for beginners this is a simply way to find hack with less effort and it saves time to, But make sure you have anti virus activated before trying to get some Serials, Patches to avoid data loss

Just follow the steps as instructed below

1) Go to http://www.google.com
2) type this syntax in search bar " 94FBR"
3) Replace Product name with desired software and leave a space then type 94FBR
4) Press enter, thats it

Now you receive Many pages which contains Serial no, Crack, Patches....

Just make a try, this simple trick works for many people

AlertBox keeps an eye out for site updates

RSS is great technology, but one of its shortcomings is that it doesn't always represent all of a site's content stream. Many times there are parts of a news or content site that change either through an editorial hand, or with items chosen by users. A new Firefox add-on called AlertBox helps track these "scraps" of content, and can be used to keep an eye out for any changes. This includes things like price changes, edits or updates to a news story, and the top stories on content sites.

To make sure it's not looking for activity on an entire Web page, AlertBox is designed to let you grab bits and pieces of any site--not the entire thing. Once installed, you can summon it by clicking the little bell shape in the bottom corner of the browser, or using a keyboard combination. It then pops up with a selection screen that, similar to Apple's Web clips widget, lets you pick what part of the page you want it to track. You can then choose how often you want it to check for future changes in increments of two minutes, up to one day.

The AlertBox in-box lets you keep track of all your alerts, and delete ones you no longer use.

(Credit: CNET)

AlertBox's way of tracking new content is an in-box-style counter down in the bottom of your browser. When clicked, it takes you to a page of Web clippings that are constantly updated with whatever the latest text is of the page elements you had selected. To be honest, this part of the add-on could use a little work, as it's just a text rip that loses all of the formatting on the page. And all of these alerts are housed not in the cloud, but on your local machine, which has two big downsides: One is that you need to have Firefox going at all times for it to alert you. The other is that you can only access those alerts on that particular machine.

Faults aside, I really like the idea of creating a simple in-box of changing content that does not rely on RSS. I think this, with a little bit of archiving to let you track changes in content throughout the day (like Web archiving service Iterasi does), would make for a very useful alternative to widget start pages and feed readers.

BIOS BEEP codes!!

When a computer is first turned on, or rebooted, its BIOS performs a power-on self test (POST) to test the system's hardware, checking to make sure that all of the system's hardware components are working properly. Under normal circumstances, the POST will display an error message; however, if the BIOS detects an error before it can access the video card, or if there is a problem with the video card, it will produce a series of beeps, and the pattern of the beeps indicates what kind of problem the BIOS has detected.

Because there are many brands of BIOS, there are no standard beep codes for every BIOS.

The two most-used brands are AMI (American Megatrends International) and Phoenix.

Below are listed the beep codes for AMI systems, and here are the beep codes for Phoenix systems.

AMI Beep Codes

Beep Code Meaning

1 beep DRAM refresh failure. There is a problem in the system memory or the motherboard.

2 beeps Memory parity error. The parity circuit is not working properly.

3 beeps Base 64K RAM failure. There is a problem with the first 64K of system memory.

4 beeps System timer not operational. There is problem with the timer(s) that control functions on the motherboard.

5 beeps Processor failure. The system CPU has failed.

6 beeps Gate A20/keyboard controller failure. The keyboard IC controller has failed, preventing gate A20 from switching the processor to protect mode.

7 beeps Virtual mode exception error.

8 beeps Video memory error. The BIOS cannot write to the frame buffer memory on the video card.

9 beeps ROM checksum error. The BIOS ROM chip on the motherboard is likely faulty.

10 beeps CMOS checksum error. Something on the motherboard is causing an error when trying to interact with the CMOS.

11 beeps Bad cache memory. An error in the level 2 cache memory.

1 long beep, 2 short Failure in the video system.

1 long beep, 3 short A failure has been detected in memory above 64K.

1 long beep, 8 short Display test failure.

Continuous beeping A problem with the memory or video.

Phoenix Beep Codes

Phoenix uses sequences of beeps to indicate problems. The "-" between each number below indicates a pause between each beep sequence. For example, 1-2-3 indicates one beep, followed by a pause and two beeps, followed by a pause and three beeps. Phoenix version before 4.x use 3-beep codes, while Phoenix versions starting with 4.x use 4-beep codes. Click here for AMI BIOS beep codes.

4-Beep Codes

Beep Code Meaning

1-1-1-3 Faulty CPU/motherboard. Verify real mode.

1-1-2-1 Faulty CPU/motherboard.

1-1-2-3 Faulty motherboard or one of its components.

1-1-3-1 Faulty motherboard or one of its components. Initialize chipset registers with initial POST values.

1-1-3-2 Faulty motherboard or one of its components.

1-1-3-3 Faulty motherboard or one of its components. Initialize CPU registers.




1-1-3-4 Failure in the first 64K of memory.

1-1-4-1 Level 2 cache error.

1-1-4-3 I/O port error.

1-2-1-1 Power management error.

1-2-1-2

1-2-1-3 Faulty motherboard or one of its components.

1-2-2-1 Keyboard controller failure.

1-2-2-3 BIOS ROM error.

1-2-3-1 System timer error.

1-2-3-3 DMA error.

1-2-4-1 IRQ controller error.

1-3-1-1 DRAM refresh error.

1-3-1-3 A20 gate failure.

1-3-2-1 Faulty motherboard or one of its components.

1-3-3-1 Extended memory error.

Create A Undetectable Hidden Folder :)

Do You Guys Ever Wanted To Hide Something In Your PC From Your Parents,Friends,Brother,Sister Etc ?0†7 [br]
But U Cant And Ending Up On Installing Some Software Like Password Lock Which Is Very Complicated And Time Wasting !! [br]


Today I Will Teach You How To Hide Folders Without Using Software !!
[br]
There Are 2 Processes 2 Hide A Folder !! [br]
First Of All The Easy Process.
[br]
>Create A Folder [br]
>Then Left Click And Then Click Rename. [br]
>Delete The Full Name Of The Folder And Press.. [br]
>Alt+999999999 (9 Times Nine No. On Your Numpad) [br]
>Click Outside The Folder Name Area. [br]
>You Will See That The Folder Will Have No Name [br]
>Then Click That Folder And Go To Properties,Customisation And Change The Folder Icon. [br]
>Note : In "Folder Icon" Folder You Will See Some Blank Spaces,Select One Of The Blank Spaces And Click Ok.. [br]
>Now You Hidden Folder Is Ready Open It And Store Your Secret Files !! [br]
[br]
[br]
Now 2nd Process Is Super Hide Using Command Line Interphase !! [br]
Little Bit More Tricky Than The Previous One !! [br]
*Note: Suppose I Am Hiding The Folder Named "Files" In C-Drive. [br]
>Click Start Button And Thun Click Run [br]
>Type "Cmd" In Run Box Appears And Click Enter. [br]
>In Dos Command Prompt Type The Following Codes.. : [br]
cd/ Then Press Enter [br]
*Then GoTo The Drive/Folder (In Dos Prompt) Where Your Folder Is Located,Mine Is In C..
C: And Press Enter [br]
*If Your Folder Is Inside Another Folder The Go To That Folder From Command Prompt Usin Command [br]
cd Then Enter.
[br]
# Note : Donot Go Inside The Folder You Want To Hide.
[br]
*My Folder Is C:/Files,And Therefore I Have Gone Till C Drive. [br]
Then After Reaching The Folder Type The Command
[br]
attrib +b +h
[br]
*This Command Will Hide Your Folder And To Un-Hide It Again Follow The Same Process But The Last Command Will Be : [br]
attrib -b -h
[br]

I Hope You Have Liked This Post ! [br]
Please Say Thanks If You Have Liked This Post.

Sending .exe files in mails via attachments.

Generally standard E-mail service providers does not allow to send exe file as an atttachment. Just follow these steps. You can send .exe file as an attachment.

Step 1:
Remove the .exe extension. To do this Open My Computer - Tools - Folder options - view and uncheck "Hide extensions for known file types. (If it is checked) Now remove the .exe extension of the file u would like to send. To do this, just right click on the perticular file name and select rename option. If u do so windows gives a warning. Just ignore all. But say the recipient that add .exe extension to make that perticular file as valid.

Step 2:
change the .exe extension to .txt or .doc. Not only these two, give any other one, if that extension not exist also. Even u can use Mac or Linux extensions also. But don't forget to inform the receiver about original extension and remaining steps.

Step 3:
You don't like to remove the .exe extension and you would like to send. For this also there is an option. Put the perticular file in a folder and give a name to it. Like "Sending File" etc. Now make a zip file for this folder. To do this job, there are many free and propritory compression softwares are available in the internet. Select any software you would like to use. Create a zip file. Not only .zip extension, you can use any other compression extension but the thing is the receiver should have the corresponding software to decompress the file. Now remove the extension for this compressed file and send it as an attachment. The last thing is don't forget to inform the receiver.

The above ideas even works to send exe files which contains virus and malware also.

I hope so this information is useful. Any doubts plz post. I will reply as soon as possible