[Konloch]

A friend of mine CryptoToad released a thread on another forum of him reversing this, I decided to take a look at this.

For those of you who are interested in what Keyword Bee Pro actually is, read this.

It's completely unobfuscated, on top of this the developers NOT ONLY left a few hardcoded serial keys inside of com.keywordbee.utility.SerialnumberManager.class BUT THEY ALSO have a function which returns a valid serial key called generateSerialNumber() INSIDE OF THAT CLASS.

Instructions:
1) Download http://keywordbee.com/downloads/KeywordBee.zip
2) Extract it, run the program
3) When prompted, enter one of the serial keys below.

Serials:

Code:

SO735559926219831177
GG445123810754069481
DW969128895072121830
FJ794273332347512766
SX300490764258950640
FC078324887409091488
XX030187452693347973
SQ815084426237498973
NU413946766830890133
ZO336946133445979824
MQ318407797812954807
AO689085088625810367
CM280599398836832565
OL797211692142903216
DM627759008170295796
ZW106110027375912900
LL774466110860623236
GS855153122453471115
YD253134362698202376
OH471064336787099898
NU715513299159967956
UE455451601544936928
PZ877135481355393702
UM281435876128036278
DF333326384853904548
XM869785385435177580
CR023920057091070441
DW570586841327589381
CI630496595599426134
SV513778330137914514
KU561153578253505920
QH357252314313348072
EF258294153188140263
WR029610374918980536
KL667798011572214213
MX627174991884172806
WS338626529263498266
RU674872398839442708
SO191718341278645446
OT566868746180207556
TP535936322345591466
OJ356515728575792841
DE773753995582584255
YQ355118890336489755
SQ562138436629832481
OE268367623568503227
PL246210598874740158
ZG265918700210421924
EQ642725533473782454
JK348439245361338888

Code To Generate New/Valid Keys:

Code:

public class WordbeeKeygen {
    /**
     * Reverse Engineered by @Konloch (http://konloch.me)
     * @return
     */
      public static String generateSerialNumber()
      {
        String serialNumber = "";

        serialNumber = serialNumber + Character.toString((char)(int)(65.0D + Math.random() * 26.0D));
        serialNumber = serialNumber + Character.toString((char)(int)(65.0D + Math.random() * 26.0D));

        for (int i = 0; i < 18; i++)
        {
          int r = 0;

          if (i == 17) {
            long ct = crossTotal(Long.valueOf(serialNumber.substring(2)).longValue());
            r = (int)(9L - ct);
          } else {
            r = (int)(Math.random() * 10.0D);
          }
          serialNumber = serialNumber + r;
        }

        return serialNumber;
      }

      public static boolean isValidSerialNumber(String serialNumber)
      {
        try
        {
          if ((serialNumber != null) && (crossTotal(Long.valueOf(serialNumber.substring(2)).longValue()) == 9L) && (serialNumber.length() == 20))
          {
            return true;
          }
        }
        catch (Exception e) {
        }
        return false;
      }

      private static long crossTotal(long s) {
        if (s < 10L) {
          return s;
        }
        return crossTotal(crossTotal2(s));
      }

      public static void main(String[] args)
      {
          for(int i = 0; i < 50; i++) {
              String s = generateSerialNumber();
              if(isValidSerialNumber(s))
                  System.out.println(s);
          }
      }
      public static long crossTotal2(long s) {
            if (s < 10L) {
              return s;
            }
            return crossTotal(s / 10L) + s % 10L;
      }
}

If you're really interested as of how you would crack this without using one of the valid serial keys (bytecode editing), all you need to do is edit the function com.keywordbee.utility.SerialnumberManager.isValidSerialNumber(String serialNumber) to return a true boolean. (Here's the actual code from that class):

Code:

public static boolean isValidSerialNumber(String serialNumber)
  {
    try
    {
      if ((serialNumber != null) && (crossTotal(Long.valueOf(serialNumber.substring(2)).longValue()) == 9L) && (serialNumber.length() == 20))
      {
        return true;
      }
    }
    catch (Exception e) {
    }
    return false;
  }

As you can see, this program offers only the extreme basics, I recommend anyone beginners learning Java Reverse Engineering who want a real world application to reverse engineer try this.

[Mooney]

Am going to try this my first app to reverse.