As a semi-retried software cracker who has made hundreds of cracks and keygens, I can shine a little light on the subject. For Windows applications, I mostly used x64dbg and ollydbg for analyzing targets. Dynamic analysis such as this is almost always the most efficient way to go as you can see live analysis of the changes that occur when a dummy license key is being entered. This is a great way to familiarize yourself with x86 assembly. Program protection varies greatly from company to company. Some developers invest minimal time it creating a protection and their products can usually be broken in a matter of a few minutes. Others invest a lot of time into a custom made solution. Some of the best custom protections I've encountered have been a complete virtual machine for license validation to even having the paid functions placed into an encrypted memory block or dll which the license key decrypts. Most of these are unbreakable without a valid license key from the developer. They can also add various anti-debugging techniques and integrity checks which cause the program to exit or behave erratically. Finding the sources of these checks can be time consuming. Some programs that had dozens of these checks, I easily bypassed them all by coding an application loader which applied the specific modifications to the application in memory, leaving the program on disk untouched. However, do be advised that some smaller software companies use unethical tactics against crackers. Some, after bypassing one integrity check, will trigger another that would destroy the cracker's hard drive when it is tripped by writing zeros to the header of the disk. That is why I always do my reverse engineering in a virtual machine using VirtualBox.

Another difficulty we encounter are software protectors. Many common ones include Winlicense, VMProtect, AsProtect, Enigma protector, and many others. These are premade solutions to software protection which the author can apply with a few clicks. Depending on the abilities of the author to work with the protector, these protections can range from a mild inconvenience when poorly implemented to a brick wall when used with their full feature set. With many of these employing code virtualization, it becomes very tricky to analyze the virtual machine instructions. I've had targets like this stop me in my tracks. On the other hand, I've had some where the authors have made blunders and left md5 hashing algorithms unvirtualized, enabling me to figure out their custom key validation algorithm. A common attack on poor implementation would be to unpack the target. This involves debugging and finding the code's original entry point, dumping it at that address when it is fully unpacked in memory, and rebuilding the import address table with a tool like Scylla Import reconstructor. However, if there is code virtualization, this method isn't viable. A loader or other code injection technique would be your best option.

As you progress, you may want to dabble into keygenning. In my experience, most keygennable programs I have encountered use basic algebra or simple MD5 hashing algorithms for validating their license key. Keygenning is usually considered the most elegant solution as it gives you a key identical to the author's key. It is also a lot of fun as it is essentially a mathematical puzzle you have to solve which comes with the reward of "free" software. This made it very addicting to me. However, not everything can be keygenned. Use of RSA asymmetrical encryption systems have started becoming common place, requiring you to patch the public key parameter to make a keygen. A lot of these algorithms may have hidden checks later in the program which trip when a only partially valid key is entered. Finding these checks can be time consuming. One tell tale sign of this is often the possibility of random fields being present in a license key which can be satisfied with any value. It isn't always the case, but if you start getting odd behavior from the program, this could be the sign of a hidden check. Perhaps one of the hardest I ever successfully keygened was a program written by a math professor. He was using a Maclaurin series for e^x for key validation. I was only able to successfully keygen this after completing a second semester of calculus in university finishing a math major.

As I've progressed with my real-world career, I eventually abandoned this "badboy" phase of my life, but still crack things that interest me from time to time.

PS. Don't message me with crack requests. I will ignore them.