|
#1
|
|||
|
|||
PCGuardKeygen - PCGuard key tool
PCGuardKeygen - PC Guard key tool
PC Guard V6/v5 DEMO keygen is able to: 1. Generate button: Generate "Activation Code" for PC Guard, serials are generated from "Program ID" and "Site Code" (HID) 2. Decode button Decode "Program ID" from "Activation Code" and "Site Code" (HID) 3. Verify button Verify "Activation Code" and "Site Code" is required, Not too strong check since just check 1 CRC32 byte. 4. Brute Site button Decode "Program ID" from "Activation Code" while "Site Code" is brute forced; SiteCollection.binary is generated containing "Site Code"+" "+"Program ID"+0D0A (last is newline termination) This will not test if "Program ID" is valid, a new tools has to be created for that task. "Program ID" has 24 hexadecimal numbers length (3 dwords) "Site Code" has 8 hexadecimal numbers length (1 dword) "Activation Code" is like: 7000074C-9598DD6C-78CBB23F-EF0156B4 https://www.calculateme.com/time/minutes/to-days/ Expected time for 4. Brute Site button would be approximately 4 hours. |
The Following 5 Users Gave Reputation+1 to CodeCracker For This Useful Post: | ||
conan981 (10-28-2019), DCA (11-06-2019), Mahmoudnia (10-27-2019), niculaita (10-27-2019), wilson bibe (10-27-2019) |
The Following 38 Users Say Thank You to CodeCracker For This Useful Post: | ||
alekine322 (09-21-2022), Apuromafo (10-27-2019), Avi_RE (11-14-2019), besoeso (10-28-2019), bolo2002 (10-27-2019), cachito (10-29-2019), canopus (10-29-2019), Codeman (06-19-2023), Coder (11-27-2022), conan981 (10-28-2019), CrackDJ (09-06-2023), DCA (11-06-2019), Doit (05-06-2020), Dxer (10-11-2023), flightwatch (10-29-2019), Hess (10-16-2023), iNomex (08-20-2021), Kurapica (10-27-2019), Mahmoudnia (10-27-2019), msaly (12-17-2019), niculaita (10-27-2019), nikkapedd (10-28-2019), NoneForce (10-28-2019), serseri_1453 (02-21-2020), sh3dow (04-28-2022), SinaDiR (10-13-2023), squareD (11-14-2019), Ura (05-01-2022), Vosiyons (05-05-2023), wilson bibe (10-27-2019), zeuscane (10-27-2019) |
#2
|
|||
|
|||
Some info on how you could modify this to also work for Full version:
seems that under full version the only different thing is a dword which come after site_code: uint32_t ToBeHashed[2]; ToBeHashed[0] = site_code; // we need site code for decoding ToBeHashed[1] = 0xA264D581; // this should be changed You should grab it from target program: Here is the first PC Guard check serial length: 009CA211 83F9 23 CMP ECX,23 009CA214 9C PUSHFD 009CA215 EB 01 JMP SHORT 009CA218 and this will move in eax the dword which should be fixed: 009CA74F 8B85 10B74100 MOV EAX,DWORD PTR SS:[EBP+41B710] 009CA755 60 PUSHAD 009CA756 E8 03000000 CALL 009CA75E 009CA75B 83EB 0E SUB EBX,0E 009CA75E EB 01 JMP SHORT 009CA761 How you should trace PC Guard: if you are after the actual check you should set a breakpoint before where current call get called; - restart Olly (not bother on trying to fallow jumps), you will also see some loop: just set breakpoint on exit door. |
The Following User Gave Reputation+1 to CodeCracker For This Useful Post: | ||
Mahmoudnia (11-14-2019) |
The Following 3 Users Say Thank You to CodeCracker For This Useful Post: | ||
#3
|
|||
|
|||
An important note:
PCGuard key tool can't do nothing if you don't have a valid key "Activation Code" or "Program ID" and also the program has any PE section encrypted. |
#4
|
|||
|
|||
Information:
https://foro.elhacker.net/ingenieria...t499288.0.html https://www.sofpro.com/docs/pc-guard...site-mid-codes Like I said without valid Site code and Activation code this tool is useless. For the full version still needs a dword fix: fix the second dword ToBeHashed[1] = 0xA264D581; // this should be changed Notice that size of ToBeHashed is 8, this value should be moved to ecx register. And here is the spot where ToBeHashed[0] = site code, ToBeHashed[1] is used: 007D3EE3 8A9429 38EF4800 MOV DL,BYTE PTR DS:[ECX+EBP+0x48EF38] 007D3EEA 02043B ADD AL,BYTE PTR DS:[EBX+EDI] ; EBX point to ToBeHashed 007D3EED 02C2 ADD AL,DL 007D3EEF 8AB428 38EF4800 MOV DH,BYTE PTR DS:[EAX+EBP+0x48EF38] 007D3EF6 88B429 38EF4800 MOV BYTE PTR DS:[ECX+EBP+0x48EF38],DH 007D3EFD 889428 38EF4800 MOV BYTE PTR DS:[EAX+EBP+0x48EF38],DL 007D3F04 FEC1 INC CL 007D3F06 ^ 75 D6 JNZ SHORT 007D3EDE 007D3F08 61 POPAD 007D3F09 C3 RETN 007E16DE 9ABC3F6C l?¼š 007E16E2 E3B776D5 Õv·ã ToBeHashed[1] = 0xE3B776D5; Enter old Site Code/Activation Code, click Decode, (this will get Program ID - important) enter your Site Code and finally click the Generate button. |
The Following User Gave Reputation+1 to CodeCracker For This Useful Post: | ||
mdj (07-01-2021) |
#5
|
|||
|
|||
Is there any new version?
|
#6
|
|||
|
|||
There is a good manual unpack on exetools here
https://forum.exetools.com/showthread.php?p=126058#post126058 |
The Following User Says Thank You to Daz Hat For This Useful Post: | ||
backdoor_b (11-26-2022) |
#7
|
|||
|
|||
still works?
|
#8
|
|||
|
|||
Unfortunately does not work on the latest version. Still works to brute force on old versions though.
|
#9
|
|||
|
|||
Dear @CodeCracker How did you get Program ID from Pc Guard v6 program
|
#10
|
|||
|
|||
any1 can share last version pcguard demo/full Version: 6.00.0927?
old one not work but we can get v6.00.0630 DEMO or v6.00.0050 DEMO for test Last edited by FoxB; 09-02-2023 at 14:18. |
Thread Tools | |
Display Modes | |
|
|