jas's Thread for NEW newbys Friday, 05-Feb-99 21:20:24
Okay; Hi all! Had to make some changes to things I pasted in incorrectly... I don't know what to say that has not been covered... So at this juncture I will only try to outline the proceedure in a way that a NEW newby not knowing anything at all might be able to follow to understand what the other students; crackers; are up to... Having been instructed not to use softice left me kind of out in left field without a glove; cause I just don't know very much about what I see when I use dasm; I always test my theories in ice; if the jump I change in ice REGS me...:) then I figure I did okay while in Dasm; (heheh; I guess, HUH; oh dah) If there is a physical serial to be found then I usually do okay by searching registers in ice; other things bury me. LEARNING OUR TOOLS WILL come to us as we practice and learn. I can readily see by highlighting certain suspicious conditional jumps and clicking on the... 'jump to'... box in the menu area that the jump will execute...and where it will land at various places in the code will (might) give me clues as to its purpose... (added: I did not have this note below in here as I thought I did...) Note: (HI halifax! :) YOU can actually make changes to jumps; change eax = 0; to eax = 1; ect ect ect while in DASM...I don't have the experience to do this; nor to explain how...You can find a couple examples to follow in the Sandmans essays page written by: VisualBB...http://www.proweb.co.uk/~greenway/Visualbb1.html and a couple others by this author... So first you must have Dasm installed: You can get it here in the Tools of the Trade section: http://catalyst.intur.net/~Iczelion/index.html Note: all other iczelion URLS are not working right now; the above one is... You can find this tool at many other sites as well. Okay its installed: Now we open it up: double click its icon.It pops.(opens) In the menu area you'll see the Heading: "Disassembler"; click on this name; In drop down box, click on "Open file to Disassemble"; now search for the folder you have installed Memory game95 to, and when you have it, click on the Memo95.exe icon; this will put it in the "File name" box; Now click "open" button; dasm will start disassembling and loading your program; Note all the options and "quick boxes" in the menu area... Click on the box that says "STrn Ref" The box that pops will reveal many areas of the code that you can goto just by double clicking on that line statement: When you opened this program, MeMoryGame95, and enter a user name and a fake serial and hit the Okay button; you get an error box that says: "Sorry, the registration code does not match! Try again or Cancel the registration" So this is what we will start our investigation with: In the Str Ref box, Scroll til you see the line : "Sorry, the registration code does not match! Try again or Cancel the registration" and double click on it... The idea here is: We KNOW that we are inputing FALSE information into the REG box; Right? So we are going to backtrack thru the "bad guy" info... So we can start at the "Sorry, the registration code does not match! and back-track from there.... this is where you land after you double-click: * Possible Reference to String Resource ID=61244: "Sorry, the registration code does not match! Try again or Ca" | :00405C50 683CEF0000 push 0000EF3C <<--land here... :00405C55 8D4DEC lea ecx, dword ptr [ebp-14] :00405C58 C70000000000 mov dword ptr [eax], 00000000 :00405C5E E83CA30100 call 0041FF9F We are inside the bad code area: now look up a few lines above this and U see this snippet of code: :00405C45 85C0 test eax, eax<<--? :00405C47 0F8434010000 je 00405D81<<<<<----? :00405C4D 8B45E4 mov eax, dword ptr [ebp-1C] * Possible Reference to String Resource ID=61244: "Sorry, the registration code does not match! Try again or Ca" I don't know at a glance what this area is saying to me exactly: But my guess: This will execute this jump to line number 00405D81 if eax is equal to the correct serial #; if not there will be no jump and will proceed to the next line AND proceed to the next line of code which is the "Sorry, area... As I can see (or now think) that the je is a "TRUE" value, and only when tested and found true will it jump to 00405D81, I now think I want to change this "je" to read a "FALSE" value to match my FALSE inputed fake number. In other words; by changing the "je" to a "jne" (or you might see jnz; same thing) when the test is done at test eax, eax and my input is found to be FALSE, by changing from je to jne (jump if not equal) this test will NOW BE found to be TRUE...and the jump can then happen under the FALSE disguise... DiD I loose ya? Well; now thinking I might have it chewed up I make my changes in Hex workshop; (PART II) and open the program... humm; No nags; Click on menu GAME; click on Register; opens Reg box; fill in info....click Okay.... it pops up saying; Thank You For Registering....heyheyOKAY! Now always double check to make sure that it will opened in the registerd mode...close the program and re-open it.... OH_OH The "Sorry, box pops...hummmmm; it was registered...now its not! Hummm; it would seem that there is another check what did I miss... I go back to Dasm... Ahhhh; by double clicking on the "Sorry, you bad excuse for a cracker... I see that there were TWO references to this code. The second is here: * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040B744(C) | * Possible Reference to String Resource ID=61244: "Sorry, the registration code does not match! Try again or Ca" | :0040B9BC 683CEF0000 push 0000EF3C <<--land here notice it is a differnt area; but same message. The first check was at line: :00405C50 683CEF0000 push 0000EF3C This second one is at line: :0040B9BC 683CEF0000 push 0000EF3C (The pushes are the same though; eh?) Now look to where it was (called?) referenced from... * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040B744(C) This is the jump (:0040B744(C)) somewhere in the code that forced the program to jump to this "Bad dude rising..." area... So lets go find it: Now in th Dasm menu; click on "SEARCH" and then "find Text" (yes I know there are other ways to find it; this is what Im using here) Now in the search box fill in the "find what" with: 0040B744 (make sure your right scroll bar is up at the top when you do a "down" search) Takes you inside this area of code: :0040B73A E881150000 call 0040CCC0 :0040B73F 83C408 add esp, 00000008 :0040B742 85C0 test eax, eax :0040B744 0F8572020000 jne 0040B9BC <<<--land here :0040B74A 8B45EC mov eax, dword ptr [ebp-14] So we now are fairly sure since this jump takes us to the "Crudy cracker area..." that it will have to be changed... This one is slighly different... It seems to be giving us a FALSE value...IF NOT EQUAL THEN... Lets double click on the line to highlight it...Now up in the menu area clcik on the "Jump TO" box.... YEP! Takes us here: * Possible Reference to String Resource ID=61244: "Sorry, the registration code does not match! Try again or Ca" | :0040B9BC 683CEF0000 push 0000EF3C So; we now know this one must bite the dust! We will change it to a TRUE value... This can be done by changing the jne (jump if not equal) to a je (jump if equal) Okay; I go into HexWorkshop and I now make both of these changes: HexWorshop can be seen here along with the essay: http://www.proweb.co.uk/~greenway/Es39.html First I right click on the original Memo.exe file and scroll to copy; I make a copy which is then named "Copy of..." Now I can play around in HexWorkshop without damaging the original exe file..... I open Hex Workshop and click on the "Edit" option menu; drop down box gives me the "find" option...click this and The find box pops: In the "value area" click on the HEX option; In the "FIND WHAT" area we are going to tell Workshop what area of the code we want to goto: This we do by looking at this snippet of code for our first change: :0040B744 0F8572020000 jne 0040B9BC <<<--land here :0040B74A 8B45EC mov eax, dword ptr [ebp-14] This one of the jumps we want to change; In order for Hexworkshop to find this out of all the codes its holding we want to identify the area it lives at... It lives here: 0F8572020000 To further help Workshop find it; just in case there is another line in there with the handel of 0F8572020000; we will also take a couple of #'s from the line below it; Hex work shop only will except 15 #'s; (but in Hex it wants an even amount of Nuimbers) so I'll use 14 numbers here: I'm going to take the first two numbers, "8B" from the next line:8B45EC and I will add them to 0F8572020000 So now the number I will want Hexworkshop searching for is typed in as: 0F85720200008B As other posts have already covrered; if you attempt now to go into your editor and make any changs it will not be allowed (at least in HexWorkSop it won't) because this program is "Read Only" protected. So you must right click on the "Copy" of mem95 you have made and in the drop down box scroll and click on "Properties". Now look down to the "Attributes" area; you'll see the Read Only box checked...un-check it; hit apply; Now you will be able to make changes in your editor... Now right click on your "Copy of memo95.exe" icon and in dropdown box click on HexEdit (if you are using HexWorkshop). Program opens; Click on EDIT; then on FIND; Type in 0F85720200008B Make sure the radial button in the "Value area" is marked for "HEX" and click; "Find Next" Hex will pop to this code area; now change the "85" to a "84"; this will now change the line at: :0040B744 0F8572020000 ... jne 0040B9BC to a : :0040B744 0F8472020000 ... je 0040B9BC When you have made your changes you then click on the menu "FILE"; and then the "SAVE" option; you will be asked if you want to make a bak up; I always say Yes.... Now you can follow the same proceedure above to change the other conditional jump: The code snippet was this: :00405C47 0F8434010000 je 00405D81<<<<<---- :00405C4D 8B45E4 mov eax, dword ptr [ebp-1C] So,Type into the find box: 0F8434010000... Plus the 8b from the line below; Now looks like this: 0F84340100008B In hex editor change the "84" to a "85"; which now will make the code look like this after the change: :00405C47 0F8534010000 jne 00405D81 :00405C4D 8B45E4 mov eax, dword ptr [ebp-1C] (Note: Remember; in ice the "jne" may look like this instead; "jnz" ) Save your changes as described above: Open up the program and run thru all options; players; double decks; Does the About box have YOUR user name (Pirate copy:) in it??? Close program; re-run; everything cool?????? Yep! BUSTED! BUT!!!!! this "COPY" will run registered just fine; No matter how many times you open and run it! ...As long as YOU DO NOT OPEN UP the Original exe.. ..as soon as you do ... the "COPY" you made... is now changed somehow... somewhere... (even though I went in and checked in HexWorkshop and NO changes were made to the jumps I changed)(?) the copy will revert back to unregistered....... Whatcha think is going on here.....? Okay; one last thing i would like to point out: When you find a conditional jump as: :0040B73A E881150000 call 0040CCC0 :0040B73F 83C408 add esp, 00000008 :0040B742 85C0 test eax, eax :0040B744 0F8572020000 jne 0040B9BC <<<-- here :0040B74A 8B45EC mov eax, dword ptr [ebp-14] You want to bear in mind that the CALL just proceeding any test (compare) and jump that returns a "Thank You For..." generaly is an area that you will want to step into (f-8 key) an investigate; this is generally where a "check routine" is being performed before returning to do the "test" or "compare".... Hummm; hope I covered this so a NEW newby can follow it. Hi EB; no I don't feel you let the Cheshire out of the bag... Cheerio (_)3 Jeff Jeff |
Jeff: jas's Thread for NEW newbys (05-Feb-99 21:20:24) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.