Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   PCGuardKeygen - PCGuard key tool (https://forum.exetools.com/showthread.php?t=19359)

CodeCracker 10-27-2019 00:44

PCGuardKeygen - PCGuard key tool
2 Attachment(s)
PCGuardKeygen - PC Guard key tool
PC Guard V6/v5 DEMO keygen is able to:
1. Generate button:
Generate "Activation Code" for PC Guard,
serials are generated from "Program ID" and "Site Code" (HID)
2. Decode button
Decode "Program ID" from "Activation Code" and "Site Code" (HID)
3. Verify button
Verify "Activation Code" and "Site Code" is required,
Not too strong check since just check 1 CRC32 byte.
4. Brute Site button
Decode "Program ID" from "Activation Code" while "Site Code"
is brute forced; SiteCollection.binary is generated containing
"Site Code"+" "+"Program ID"+0D0A (last is newline termination)
This will not test if "Program ID" is valid, a new tools has
to be created for that task.

"Program ID" has 24 hexadecimal numbers length (3 dwords)
"Site Code" has 8 hexadecimal numbers length (1 dword)
"Activation Code" is like: 7000074C-9598DD6C-78CBB23F-EF0156B4

Expected time for 4. Brute Site button would be approximately 4 hours.

CodeCracker 11-14-2019 02:19

Some info on how you could modify this to also work for Full version:
seems that under full version the only different thing is a dword which come after site_code:

uint32_t ToBeHashed[2];
ToBeHashed[0] = site_code; // we need site code for decoding
ToBeHashed[1] = 0xA264D581; // this should be changed

You should grab it from target program:
Here is the first PC Guard check serial length:
009CA211 83F9 23 CMP ECX,23
009CA214 9C PUSHFD
009CA215 EB 01 JMP SHORT 009CA218

and this will move in eax the dword which should be fixed:
009CA74F 8B85 10B74100 MOV EAX,DWORD PTR SS:[EBP+41B710]
009CA755 60 PUSHAD
009CA756 E8 03000000 CALL 009CA75E
009CA75B 83EB 0E SUB EBX,0E
009CA75E EB 01 JMP SHORT 009CA761
How you should trace PC Guard: if you are after the actual check you should set a breakpoint before where current call get called; - restart Olly (not bother on trying to fallow jumps), you will also see some loop: just set breakpoint on exit door.

CodeCracker 05-02-2020 12:45

An important note:
PCGuard key tool can't do nothing if you don't have a valid key "Activation Code" or "Program ID" and also the program has any PE section encrypted.

All times are GMT +8. The time now is 23:01.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX