Hello and welcome back.
In this video, we are going to reverse another Windows GUI crackme.
So go ahead and download the GUI crackme, which is called Autogen Serial, and then create a new folder
in your home directory and put it in this folder.
Put it here.
And now we are going to run it and see what it does.
Right-click and open terminal here.
In this run.
It will, let's first test it with file to see what is the...
So it is a PE 32 executable GUI program, meaning it's a Windows program.
So we are going to run it using Wine.
And this is what it looks like.
Enter first name and serial.
So let's put...
And you get a bad message.
Wrong serial key.
So now we can start to reverse this.
Yeah.
I'm going to create a new project in Ghidra.
Select the folder for the new project.
Then give it a name.
Let's call it Autogen-Serial and click on Finish.
We'll import the file.
So just drag it and drop it into the new folder.
And it has correctly detected it is a Portable Executable.
It is a 32-bit program written in Borland.
Let's click okay.
Now it's undergoing the process of importing,
and you get the import result
summary.
Click on
okay.
And here you can see also the compiler is Borland processor x86 32-bit.
Borland C++ compiler.
Click
okay.
And now we are going to start the process of analyzing by opening it with Code Browser.
So drag it and drop it on the dragon.
Click on
yes to analyze.
Over here,
select the compiler parameter ID, uncheck PDB Universal, check on Windows PE Propagate External, and
click on Analyze.
Let's close this.
And keep an eye on the lower right corner
to know when it has finished analyzing.
All right.
After a few minutes, it has finished with the analysis, so we can now go and look for some strings,
which we saw earlier.
Wrong serial key.
So head over to Search for Strings.
Click on Search.
And now it has got a list of strings, and we can filter out "wrong."
And there you go.
It's a Unicode wrong serial key.
So just double-click on that, and we can lock this by dragging the bottom blue bar to the right.
And this is the wrong serial key string is found in the listing.
Wrong serial key.
You also have error, and you also have correct key
and well done.
And there's something interesting here.
It looks like a format specifier.
Could this be the serial key?
The actual serial key.
And you can go there and take a look.
There's a cross-reference there to the function which refers to this.
So we can double-click on this to head over to the location.
And you can see more of it here.
It is contained in this function,
and if we head over to the Decompile window, we can see it here.
And you scroll down and take a look.
You get the if-else statement down here, and
the first block will show a good message.
Correct
serial key.
Well done.
Whilst the else part will be showing the wrong serial key.
So whether you get right or wrong depends on iVar2.
So we'll do the analysis in the next video.
I'll see you then.