home *** CD-ROM | disk | FTP | other *** search
/ Reverse Code Engineering RCE CD +sandman 2000 / ReverseCodeEngineeringRceCdsandman2000.iso / RCE / Mib / BB.ZIP / BB.ASM next >
Assembly Source File  |  1998-08-18  |  4KB  |  201 lines
  1. ;BrainsBreaker serial finder v1.0
  2. ;Written by Cruehead as a part of the 1999 +HCU strainer
  3. ;MASM version
  4.  
  5. .model tiny
  6. .386
  7. .stack
  8. .data
  9. info      db 'Brains Breakerv2.1 serial brute forcer'
  10.           db 13,10,'By Cruehead as a part of the 1999 +HCU strainer'
  11.           db 13,10,'$'
  12. lookitup  db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ23456789'        ;The lookuptable
  13. counter   dd 0
  14. serial    db '000000$'                                    ;We'll start testing this serial
  15. serial2   db 6 dup (0)
  16. result    db 6 dup (0)
  17. newser    db 0,0,07Fh,0,0A8h,0,07Fh,0,010h                ;Here the bytes are stored that will
  18.                                                         ;be XOR'ed with eachother to form
  19.                                                         ;the "finalbyte"
  20. finalbyte db 0
  21. damn      db 13,10,'DAMN! Serial not found!',13,10,'$'
  22. .code
  23. .startup
  24.  
  25. mov     ah,09h                                            ;Write the info text on screen
  26. lea     dx,info
  27. int     21h
  28.  
  29. xor     si,si
  30. serialloop:
  31. mov     al,serial[si]                    ;Get a letter from the serial
  32. cmp     al,'$'                            ;is it equal to '$' (the last letter of the serial)
  33. jne     continue                        ;If isnt, continue
  34. jmp     doneit                            ;Otherwise we are ready
  35. continue:
  36. cmp     al,'1'
  37. je      changeone
  38. cmp     al,'0'
  39. je      changezero
  40. mov        serial2[si],al                            
  41. inc     si
  42. jmp     serialloop
  43.  
  44. changeone:                                        
  45. mov     serial2[si],04Ch                ;Change '1' to 'L'
  46. inc     si
  47. jmp     serialloop
  48.  
  49. changezero:
  50. mov     serial2[si],04Fh                ;Change '0' to 'O'
  51. inc     si
  52. jmp     serialloop
  53.  
  54. ;---------------------------------------------------------------
  55. ; After the above loop "serial2" will be the transformed serial
  56. ; while "serial" is the original.
  57. ;
  58. ; These next lines is a copy of the protection used in
  59. ; Brainsbreaker. It works exactly the same
  60. ;---------------------------------------------------------------
  61.  
  62. doneit:                                    
  63. xor     si,si
  64. xor     di,di
  65.  
  66. lookloop:
  67. mov     al,serial2[si]
  68. cmp     byte ptr lookitup[di],al
  69. je      fixedit
  70. inc     di
  71. jmp     lookloop
  72.  
  73. fixedit:
  74. mov     bx,di
  75. mov     result[si],bl                    ;The result from the function above will be
  76.                                         ;saved here.
  77. xor     di,di
  78. cmp     si,5                            ;The size of the serial will be 6 chars.
  79.                                         ;Why did I choose 6? well...why not? :)
  80. je      everythingready
  81. inc     si
  82. jmp lookloop
  83.  
  84. everythingready:
  85. xor     si,si
  86. xor     di,di
  87. xor     ebx,ebx
  88.  
  89. goagain:
  90. xor     eax,eax
  91. first3:
  92. mov     ecx,eax
  93. mov     edx,1
  94. shl     edx,cl
  95. xor     ecx,ecx
  96. mov     cl,result[si]
  97. and     edx,ecx
  98. jz      first1
  99. mov     ecx,ebx
  100. mov     dl,1
  101. shl     dl,cl
  102. or      byte ptr newser[di],dl
  103. jmp     uncon1
  104. first1:
  105. mov     ecx,ebx
  106. mov     dl,1
  107. shl     dl,cl
  108. not     dl
  109. and     byte ptr newser[di],dl
  110. uncon1:
  111. inc     ebx
  112. cmp     ebx,8
  113. jnz     first2
  114. inc     di
  115. xor     ebx,ebx
  116. first2:
  117. inc     eax
  118. cmp     eax,5
  119. jl      first3
  120. inc     counter
  121. mov     eax,counter
  122. cmp     counter,6                       ;6=length of serial
  123. jl      moremore
  124. jmp     rrready
  125.  
  126. moremore:
  127. inc     si
  128. jmp goagain
  129.  
  130. rrready:
  131. xor     si,si
  132. xor     di,di
  133. xor     ecx,ecx
  134. mov     ebx,1
  135. mov     edx,1
  136. gogo:
  137. mov     eax,ecx
  138. cdq
  139. idiv    ebx
  140. mov     eax,offset finalbyte
  141. add     eax,edx
  142. mov     dl,newser[si]
  143. xor     [eax],dl
  144. inc     ecx
  145. inc     si
  146. cmp     ecx,9
  147. jl      gogo
  148.  
  149. ;mov        dword ptr newser[0],0
  150.  
  151. cmp     [finalbyte],0                    ;The final test!
  152. je      hurray                            ;If it's equal we got ourself a working serial!
  153.  
  154. mov     counter,0                        ;Damn, the serial wasnt correct. We got to clean
  155. mov     [finalbyte],0                    ;up our mess and start all over again.
  156. xor     si,si
  157.  
  158. inc     serial[0]
  159. cmp     serial[0],039h                    ;These next couple of lines are just increasing
  160. jle     serialloop                        ;the serial.
  161. mov     serial[0],031h
  162. inc     serial[1]
  163. cmp     serial[1],039h
  164. jle     serialloop
  165. mov     serial[1],031h
  166. inc     serial[2]
  167. cmp     serial[2],039h
  168. jle     serialloop
  169. mov     serial[2],031h
  170. inc     serial[3]
  171. cmp     serial[3],039h
  172. jle     serialloop
  173. mov     serial[3],031h
  174. inc     serial[4]
  175. cmp     serial[4],039h
  176. jle     serialloop
  177. mov     serial[4],031h
  178. inc     serial[5]
  179. cmp     serial[5],039h
  180. jle     serialloop
  181. mov     serial[5],031h
  182. inc     serial[6]
  183. cmp     serial[6],039h
  184. je      damnit
  185. jmp     serialloop
  186.  
  187. damnit:                                    ;Hopefully we wont get to here!
  188. mov     ah,09h
  189. lea     dx,damn
  190. int     21h
  191. jmp     theend
  192.  
  193. hurray:                                    ;YES! Write the correct serial on screen!
  194. mov     ah,09h
  195. lea     dx,serial
  196. int     21h
  197.  
  198. theend:
  199. .exit
  200. end
  201.