Originally published on the old depletionmode / 2of1 blog (archived copy).
A colleague sent around a link to https://www.corelan.be/index.php/2012/05/14/reversing-101-solving-a-protectionscheme/ which is a decent blog post about solving a copy protection scheme using dynamic analysis.
However the challenge notes that while any bypass is acceptable, ideally a keygen should be created.
Turns out this is extremely simple.
After cracking app17win.exe open in IDA, I’ve come up with the following solution:
#include <stdio.h>
#include <string.h>
/* usage: keygen <username> */
int main(int ac, char *av[])
{
int val = 0;
char passwd[100] = "HTS";
for (int i = 0; i < strlen(av[1]); i++)
sprintf(passwd,
"%s%s%02x",
passwd,
i % 2 ? "" : "-",
val = ~(av[1][i] << val) & ((av[1][i] - val) >> 1));
printf("%s\n", passwd);
return 0;
}