Patchme: genass3's Patch protect lite

Download here: https://crackmes.one/crackme/68d8731a224c0ec5dcedc3be
MD5: 4bbf3e44dc54b708a94e6ee1fd0be214
SHA1: 79e4ffa8820c7473887f43375745869e3f10b4dc
SHA256: 9d7448664d99560a6914589e6643736da72cb8c600d41bf7a5a37756e28e8085

This is listed as a C/C++ x64 executable with a difficulty rating of 3.0. The author is genass3 and the executable is written for Windows.

The authors description:

The diff between other versions: - Rewrited pass verification algorithm (removed the hash algorithm) - Improved string encryption - Rewrited some obfuscation things (make it easier) Your main goal is to find the password, for every user password will be different.

I enjoyed the authors previous patchme so I'm really looking forward to tackling this revamped version.

Just like their previous patchme, this is implemented as a console application. It was created using Microsoft Visual Studio 2022. The binary does not appear to be packed.

Taking a look at the strings, we see some familiar function names. If these don't look familiar, I definitely suggest you read meticulously through my previous post and take copious notes... I guess it would be fine if you just skim over it too. Whatever.

One notable change is the lack of most strings. The "failed to load user32.dll", which we saw in the previous application, lead me to believe that those surrounding strings of characters are the now encoded output strings.

I won't be too in depth in the parts that I covered in my previous post but there are some unique twists in this one. Strings are no longer readily available except for the string that lets us know the program was unable to load user32. Instead, there is a function that accepts the encoded string and a decoded string buffer. It follows the same code flow as the previous sample so we have a pretty good idea of what is going on so we won't be analyzing it any further. The really unique thing to note here is that the password is now generated based off your CPU. The ghidra decompiler struggled hard with this so you'll have to analyze the disassembly to figure out how. It involved the cpuid instruction with leaf 1 and bit manipulation.

Now that we got the nerd stuff out of the way, let's take a moment of silence for the Beep call. It was taken from us too soon. That functionality has been offloaded to the MB_ICONHAND and I hate it!
#justice for Beep.

As for the solution, it's the same approach as last time. Look for the call to CreateThread and go to lpStartAddress(the function that the thread will execute). Click on the threads tab and suspend all the threads, then patch the jumps to the bad boy code sections.

Then all we have to do is make one simple patch from JE to JMP and we get the good boy message. Because of ASLR, I didn't bother including the virtual addresses but look for the instructions around it to see where the patch needs to be made.

Seeing as how the password will be different for everyone, there is no point in trying to extract the password. However, depending on how I feel tomorrow, I may try and create a keygen.