Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   PCGuardKeygen - PCGuard key tool (https://forum.exetools.com/showthread.php?t=19359)

CodeCracker 10-27-2019 00:44

PCGuardKeygen - PCGuard key tool
 
2 Attachment(s)
PCGuardKeygen - PC Guard key tool
PC Guard V6/v5 DEMO keygen is able to:
1. Generate button:
Generate "Activation Code" for PC Guard,
serials are generated from "Program ID" and "Site Code" (HID)
2. Decode button
Decode "Program ID" from "Activation Code" and "Site Code" (HID)
3. Verify button
Verify "Activation Code" and "Site Code" is required,
Not too strong check since just check 1 CRC32 byte.
4. Brute Site button
Decode "Program ID" from "Activation Code" while "Site Code"
is brute forced; SiteCollection.binary is generated containing
"Site Code"+" "+"Program ID"+0D0A (last is newline termination)
This will not test if "Program ID" is valid, a new tools has
to be created for that task.

"Program ID" has 24 hexadecimal numbers length (3 dwords)
"Site Code" has 8 hexadecimal numbers length (1 dword)
"Activation Code" is like: 7000074C-9598DD6C-78CBB23F-EF0156B4

https://www.calculateme.com/time/minutes/to-days/
Expected time for 4. Brute Site button would be approximately 4 hours.

CodeCracker 11-14-2019 02:19

Some info on how you could modify this to also work for Full version:
seems that under full version the only different thing is a dword which come after site_code:

uint32_t ToBeHashed[2];
ToBeHashed[0] = site_code; // we need site code for decoding
ToBeHashed[1] = 0xA264D581; // this should be changed

You should grab it from target program:
Here is the first PC Guard check serial length:
009CA211 83F9 23 CMP ECX,23
009CA214 9C PUSHFD
009CA215 EB 01 JMP SHORT 009CA218

and this will move in eax the dword which should be fixed:
009CA74F 8B85 10B74100 MOV EAX,DWORD PTR SS:[EBP+41B710]
009CA755 60 PUSHAD
009CA756 E8 03000000 CALL 009CA75E
009CA75B 83EB 0E SUB EBX,0E
009CA75E EB 01 JMP SHORT 009CA761
How you should trace PC Guard: if you are after the actual check you should set a breakpoint before where current call get called; - restart Olly (not bother on trying to fallow jumps), you will also see some loop: just set breakpoint on exit door.

CodeCracker 05-02-2020 12:45

An important note:
PCGuard key tool can't do nothing if you don't have a valid key "Activation Code" or "Program ID" and also the program has any PE section encrypted.

CodeCracker 06-30-2021 14:40

Information:
https://foro.elhacker.net/ingenieria...t499288.0.html
https://www.sofpro.com/docs/pc-guard...site-mid-codes

Like I said without valid Site code and Activation code this tool is useless.
For the full version still needs a dword fix:
fix the second dword
ToBeHashed[1] = 0xA264D581; // this should be changed

Notice that size of ToBeHashed is 8, this value should be moved to ecx register.
And here is the spot where ToBeHashed[0] = site code, ToBeHashed[1] is used:
007D3EE3 8A9429 38EF4800 MOV DL,BYTE PTR DS:[ECX+EBP+0x48EF38]
007D3EEA 02043B ADD AL,BYTE PTR DS:[EBX+EDI] ; EBX point to ToBeHashed
007D3EED 02C2 ADD AL,DL
007D3EEF 8AB428 38EF4800 MOV DH,BYTE PTR DS:[EAX+EBP+0x48EF38]
007D3EF6 88B429 38EF4800 MOV BYTE PTR DS:[ECX+EBP+0x48EF38],DH
007D3EFD 889428 38EF4800 MOV BYTE PTR DS:[EAX+EBP+0x48EF38],DL
007D3F04 FEC1 INC CL
007D3F06 ^ 75 D6 JNZ SHORT 007D3EDE
007D3F08 61 POPAD
007D3F09 C3 RETN

007E16DE 9ABC3F6C l?¼š
007E16E2 E3B776D5 Õv·ã

ToBeHashed[1] = 0xE3B776D5;

Enter old Site Code/Activation Code, click Decode, (this will get Program ID - important)
enter your Site Code and finally click the Generate button.

backdoor_b 04-28-2022 02:01

Is there any new version?

Daz Hat 09-18-2022 12:55

There is a good manual unpack on exetools here
https://forum.exetools.com/showthread.php?p=126058#post126058

Pacobiz 09-19-2022 02:17

still works?

Vosiyons 05-24-2023 14:44

Dear @CodeCracker How did you get Program ID from Pc Guard v6 program

FoxB 08-31-2023 16:58

any1 can share last version pcguard demo/full Version: 6.00.0927?

old one not work
but we can get v6.00.0630 DEMO or v6.00.0050 DEMO for test

th3tuga 10-03-2023 23:52

Quote:

Originally Posted by Pacobiz (Post 126065)
still works?

Unfortunately does not work on the latest version. Still works to brute force on old versions though.


All times are GMT +8. The time now is 18:02.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX