Hello and welcome back.
In today's video, we are going to try another GUI crackme called Simple Serial.
So go ahead and download this crackme and put it in this folder.
See Ghidra projects.
Crackme-dash-two.
Let us first run it.
Then enter any zero and hit the button.
Check, and you get a bad message saying sorry, wrong key.
So now I'm going to show you how to solve this crackme.
Fire up Ghidra.
Click on File, New Project.
Click on Next.
Click on the three dots.
And go to your folder where you saved your...
crackme.
And click on it and click on Select Project Directory.
For Project Name,
call it GUI
crackme-two, and then click on Finish.
Now we import the crackme.
Drag and drop it into the folder here.
It has detected it to be a PE file format and it is a 32-bit program.
Click
OK.
It is now importing it.
Can resize this window, dragging down a bit.
This is the import results
summary.
Click
OK.
Let's go and start analysis.
Drag this and drop it on the dragon.
Confirm to analyze.
Yes.
And analysis window,
check on the Compiler Parameter ID.
Uncheck PDB Universal. Check on Windows x86 Propagate.
Analyze. It will take a few minutes to analyze this.
So just analyze.
Watch the bottom right corner and you will note that it is finished now.
And now we can analyze.
We can go to the
Exports here.
Look for the entry.
And then this is the entry point.
And if you scroll down, the WinMain should be
probably this one,
after getting all your, getting startup info and whatnot.
But we are not going to use that method to solve this crackme.
We are going to look for strings.
Now we know that the string is "sorry, wrong key."
So we can look for it by using the search, string, search for strings.
And click on Search.
And then filter out
"sorry."
And you have one hit.
It's a Unicode.
Double-click on it.
And you will come to this location.
S-O-R-R-Y.
It is Unicode.
A Unicode consists of two bytes for each character.
The ASCII as well as the zero byte.
So,
every character has got an ASCII code followed by the zero byte.
So for S, the bytes are 53 and 00. O is 6F and 00.
The H at the back means is hexadecimal and so on.
So now, since this is Unicode, if we scroll up, we can see other strings.
Correct?
Correct.
Key.
Thank you.
And this probably is the serial key.
ABC-123456.
So just by searching for strings, we probably have solved it.
So if we try this key now, see what happens.
A-B-C-dash-
one-two-three-four-five-six.
Click on Check, and it's correct.
So this is how easy you solve it.
Now I'll show you a different way to solve it.
I also want to teach you how to convert
one particular representation into another data type.
So this is all in Unicode.
You can convert it into data.
So we select the first one.
C or Z and go down all the way to
"Thank you.
Sorry, wrong key" errors.
And somewhere around here.
Press down the Shift, hold it down, and click here.
So you have selected all the green parts.
Then you right-click on it and then select Data and select Terminated Unicode.
The word "terminated" means it ends with the null character.
Enter the null terminator.
So click on this one and it will convert all that, group it together into, into strings,
Unicode strings.
So now you can see "Correct key" is a string.
"Thank you,"
string.
"Sorry,
wrong key,"
string.
String.
If you want to undo this, you can just click on the Back button to undo.
Or another way is you can select all of this and then right-click.
And then select
Clear.
Clear Code Bytes, and then it will go back to its raw format.
Okay, now let's redo it again.
You can right-click
and then
Data, Terminated Unicode.
Okay, so now you have the strings.
We can see clearly where all these are.
Okay.
So if you, these are the cross-references to the strings.
So we can try this and see where it leads us.
Notice if you hover your mouse over this,
you pop up this additional display and you can scroll.
If you want to disable this feature, just click on this one time and click another time and you can
see it has been disabled.
So now we can follow the cross-references and double-clicking this, and we can see that it is being referenced
here.
Now, I have tried this method by cross-referencing and didn't have much luck with it, so I'll show
you another way to solve this.
So the way to solve this is to use the help of a debugger to locate the address for the code which uses
these strings.
So I'll show you that in the next video.
Thank you for watching.