The program uses the insecure gets_s but limits to 63 characters – no overflow. The real work is in check_serial . 3.3. The serial‑checking routine In Ghidra the function is named check_serial (address 0x140001560 ). Its decompiled pseudo‑code (after some renaming) looks like this:
| Tool | Purpose | |------|---------| | | Verify that the binary is not packed. | | x64dbg (or OllyDbg ) | Dynamic debugging, breakpoints, watch registers. | | Ghidra 10.2 | Static disassembly & de‑compilation. | | Strings | Quick view of embedded literals. | | Python 3.10 | Write a small key‑generator script (optional). | | procmon / Process Explorer | Observe any hidden anti‑debug syscalls. | Tip: Run the binary once under a debugger to confirm the presence of anti‑debug checks (e.g., IsDebuggerPresent , CheckRemoteDebuggerPresent ). If they crash the program, we’ll patch them out later. 3. Static Analysis 3.1. Basic PE info File Type: PE32+ (64‑bit) Entry point: 0x140001010 Sections: .text 0x2000 (code) .rdata 0x1000 (read‑only data) .data 0x0800 (mutable data) .rsrc 0x0400 (resources – contains UI strings) The .rdata section contains the two strings we’ll see in the UI:
# 3. Invert the per‑byte transform to get the actual serial serial_bytes = bytes(invert_transform(b) for b in transformed) serial = serial_bytes.decode('latin-1') # keep raw bytes, printable check later print("[+] Serial candidate:", serial)
t(i) = ROL8( c_i XOR 0x5A, 3 ) ROL8 rotates an 8‑bit value left by 3 bits.
int __cdecl check_serial(const char *s) uint8_t buf[9]; // 9‑byte “key” derived from input size_t len = strlen(s); if (len != 9) // must be exactly 9 characters return 0;
# ------------------------------------------------------------ # 1. CRC‑32 parameters (same as the binary) POLY = 0xEDB88320 INIT = 0xFFFFFFFF XOROUT = 0x00000000
# Inverse table: given a CRC value and a trailing byte, find the prior CRC INV_TABLE = ((crc ^ b) & 0xFF) : (crc ^ b) >> 8 for b in range(256) for crc in range(256)
"Enter your serial: " "Invalid serial! Try again." "Correct! Welcome, Adeko." Opening the binary in Ghidra and navigating to entry_140001010 (the default WinMainCRTStartup ) quickly leads to the call:
def crc32_step_rev(crc, b): """Reverse one CRC‑32 step (process byte b at the *end* of the stream).""" # The forward step is: crc = (crc >> 8) ^ TABLE[(crc ^ b) & 0xFF] # Reversing: idx = (crc ^ b) & 0xFF prev_crc = (crc ^ TABLE[idx]) << 8 prev_crc |= idx return prev_crc & 0xFFFFFFFF