How Hackers Crack Any Software With Reverse Engineering

0:00 Hackers hack software. We say that all the time, but what does that actually mean? In this video, I want to go into a little bit of the process of how hackers take apart software through the process of reverse engineering. Here we have this file. Uh it's called key gen. Keygen is a very simple program that takes a name and a key associated with it. Right? We want to figure out what is the process that the program uses to determine if a key is correct or not. This process is known as reverse engineering. is how hackers take programs apart and crack them to figure out what their internals look like and if they have inherent vulnerabilities. Now, so Keygen me is a program that kind of simulates the world of 2000's era software, right? Where you have a CD and you have a serial code that comes with it to validate that you've actually

0:45 purchased the software, right? We don't want anyone able to just to download the software. And so, as a result of this, hackers figured out, okay, there is a way to deterministically generate these keys. And the keys kind of became this, you know, infamous lore in the world of reverse engineering. And now we have these programs that are called keygen mises. Keygenesis are a form of reverse engineering challenge that kind of act as a practice for hackers to figure out what goes on inside programs. So if we go to keygenme, we see it takes two parameters here. I have the name and the key. So these are the parameters that I have to put in. The name is like my login. So we'll say my name is lowle here. And then the key is the the key that I'm trying to to to hack, right? So if I put in asf, you'll see, okay, we have the wrong key. That's kind of where the program ends. And I'm assuming

1:31 there's some end state that uh says, hey, you got the right key. So it's my job as the hacker to figure out what is the process that goes on inside of the program that enables us to get the right key. Kind of a first glance, what you can do is run the strings program on this to see if maybe there's some built-in keys. And you'll see this program is actually very simple. There aren't a ton of imports. It imports the puts function sterland a to i and then kind of we just have the basic strings right the name and the key good job which I'm assuming is the you did it function and then the wrong key and then just kind of like the metadata of the elf the file that comes in. So that's kind of where it ends. We have to now actually go into the program and see what's going on on the inside. By the way, when we're going inside of a program, what we're really doing is taking apart the assembly of the program

2:16 to try to infer what the source code did. If you're not aware of the source code compilation process of a program, we start with a language like this which is fairly human readable and expresses the human intent of the program in a language that is more readable to us than machine code than binary, right? And so we have these labels like integer x and we have this label print f and this label main. But these labels, these human readable labels are not things that the computer actually cares about, right? So what we have to actually do is take the parts that the computer does care about the instructions and reverse the process of compilation to infer what these labels mean and as a result the ultimate human intent of the program. Now what we can do is use a program that's called a decompiler or disassembler to get this intent. Right?

3:04 One of them I like to use is called binary ninja. Binary ninja is a kind of the go-to bread and butter in the hacking community for people that want to learn reverse engineering. So we're going to go here. We're going to go to the key gen program. We're going to open it. And you'll see very quickly we get this really really nice high-level instruction language or this highle intermediate representation that tells us what the program does. Right? What this program binary ninja is doing is it is taking the assembly of the program. It is reconstructing it into basic blocks and inferring based on the structure of those basic blocks what the program is trying to do. And we can see here we have the call to puts on wrong key and then the puts to uh good job. So what we want to do now is kind of reverse engineer based on what we're seeing here based on this control flow graph. What are the conditions required

3:51 to get to good job. So first of all obviously we have to have arg equal to three. Arg being three means we put in three parameters. The first being the name of the program and then the second one being our name and then the key itself. So then what we do is we run this little function here called sub41159. We'll figure out what it does here in a second on arg1. So argv1 is the second parameter which is actually the name of the program. Let's go into this function here and see what it's doing. Okay, so we're going to say just this is a a string. We know this is just an arbitrary string that we give it. So we'll call it stir. and we say while some variable is less than sterlin of stir some variable plus equals the value inside of the stir. Okay, so what we're doing here is we are actually just

4:38 getting the sum of a string, right? We are taking the string which is just a concatenated bunch of characters which are just numbers and we are adding them all together. So we can literally just call this function sum. Okay, if we go back over here on the bottom left, we'll see what area calls this. So we say if the sum of the name exord with the first character of the name times three left shifted by the sterling of argu. Okay, we have a bunch of different little pieces we have to solve here, right? This is kind of you know the nature of uh of re is solving many problems. So the first problem we solve is this sum function. Now we need to be able to do the first character of arg v1 * 3. So the first character of arg1 in the case that we're going to run this is going to be l right for lowle. So I'm going to

5:24 try this again just to show you what we're looking at. Uh low-level TV is what we'll do. And we see that the first character here is L. Okay. So we have to say uh the sum of all the characters exord with the first character times three and then left shifted by the sterlin of arg0 which is the name of the program. So let's let's solve all this first. So going to Python 3, we can do the sum of low-level TV. Okay. So what is the sum of that? The sum of all these characters together. The asky value that they represent is 1108. Okay. So we'll take a note of that for right now. So I'll make a little notes file. So the sum of low-level TV is 1108. And then what is the next part? We have to do the exord with the first character time 3. Okay. So what is the uh ordinal value of

6:10 L? Right? It's going to be 108 and then times three. So 324. But the question is what is the size of this? It is the um the dword of this. So the character pointed to this time 3. Okay. So we have 1108 is our sum and then the first character* 3 is 324. Okay. So we have to do 1108 exord with 324. Right? And then we're going to go back to our next part. Left shifted by the first part of argv. It's arg0 which is just the name of the program. Right? The name of the program is going to it says keygen me. But what you should know is that whenever you run a program, you actually end up getting this larger string that has the dot slash, right? Because when I run the program, arg0 is actually dot slashkey gen, right? So we'll do Python 3 and get

6:58 the length of this string, which is 10. Okay, let's go back to our notes real quick. Um, so you have to do 1108 exord 324 and then left shifted by 10. Let's try that real quick. Let's see what this number turns into. Python 3 510. So this is our value. Apparently this is our magical key. So we'll do key gen me low-level TV and bada bing bada boom. Good job. That's our number. Guys, reverse engineering is not complicated. Right? At the end of the day when you receive a program the program is doing some kind of functionality. Meaning it has to have the machine code instructions on the inside that tell you what to do. Now obviously there are layers of obfiscation that can happen. There are

7:43 things that can get weirds out of a program. But if you can go into the program, read the assembly, read the higher level representations of that program, you can reverse engineer the functionality and figure out what it's doing. This applies to real world programs. This applies to malware. Pretty much anything that runs on your machine natively, you can figure out what it's doing. By the way, guys, if you found this interesting, my community, Stack Smash, is now live. We have hundreds of members that are learning how to reverse engineer and find bugs just like this to make the world a more secure place. If you like that, go check it out. Anyway guys, that's it for now. Thanks for watching. I appreciate it. If you like this video, go check out this other video where I did a crack me just like this one. We'll see you there.