Posted by HaQue on 1/21/2000, 5:15 am
203.56.239.111
Greetings!
I left my notes at work, and the floppy vanished(things need to be bolted down
at that place!). I wasn't going to worry about posting the answer to first 2
tasks, as they have been explained already quite extensively, but I think I
need to fo my own benifit primarily. so I here are my answers to
task I. You may be bored by now with task I, but I would appreciate comments
If anyone could spare the time.
regards,
HaQue
================================================================================
I.1 What do you find when you look at the target first?
look what you find, when you look at the program, at the
helpfile or somewhere else. Be sure not to use *any* tools
yet, only look directly at the program.
--------------------------------------------------------------------------------Once the program is started, a window pops up displaying the amount of
days left in the trial, and Evaluate, purchase and Register buttons.Clicking the Evaluate button gets you into the program on a trial basis.
Clicking the purchase button brings up the programs help. The help contains the vital
information that the license key can be emailed. this tells me that the program is a
full version that can be cracked, and not just a demo that once the fee is paid, the
full program is then sent.Clicking the register button brings you to a box that takes 3 inputs:
- Name
- Company
- Key Codeentering in false data gies the message :
"The Key does not match the license owner"
It does not seem to have a limit on how many tries you can have before it shuts down.
If you choose to evaluate it, there is no way to register from the program; you need
to shut it down to get to the register window.================================================================================
I.2 Do you find anything interested in the W32Dasm disassembly?
Now you can use a deadlisting from your favourite disassembler
and look for suspicious stuff.
--------------------------------------------------------------------------------
Using the string, menu & dialog ref's in w32dasm....
"Day %d of your 30 days trail period.""AC200-%d"
"Registered to "
"RegisterInfo"
"Software\Acon AS\Acoustica\2.0\"
"The evaluation period has expired."
"The key does not match license "
"owner.""Unregistered"
"Your license is registered. Thank "
"you for your purchase of Acoustica "
"2.0."
================================================================================
I.3 What kind of window is the "Wrong-serial"-"messagebox" really?
As you will see later the window that says "Wrong serial" is
no Messagebox, but another kind of window.
--------------------------------------------------------------------------------
To get this, I searched for "The key does not match license" in w32dasm.
This string is shown on the bad reg screen.
I found it at line 133756 & 134079.As this text is PUSHed as a parameter for whatever the function(box) is, I
followed the first CALL after the text, and scrolled down a couple of pages.Seeing there is a "Reference To: USER32.MessageBoxExA" in such close proximity,
It seemed fair to set that as a BPX in softice.
"BPX USER32!MessageBoxExA" I type in softice, and yes it breaks.
so Laz was pulling our legs :-) it is a messagebox.
================================================================================
I.4 Where does the program store its Registration information?
In the registry, in a file, in the EXE itself - where?
--------------------------------------------------------------------------------
The registry is the most common with small apps such as this, so I always
check this first with REGMON. Some programs disguise the keys but not
this one. The keys are:
HKCU\Software\Acon AS\Acoustica\2.0\RegisterInfo\Name
HKCU\Software\Acon AS\Acoustica\2.0\RegisterInfo\Company
HKCU\Software\Acon AS\Acoustica\2.0\RegisterInfo\Key================================================================================
I.5 Where does the program store how many days are left?
Same as above
--------------------------------------------------------------------------------
So if it stores it in the registry, lets look at all the other
registry keys. There are not many keys here, so these are the
ones I am interested in:
HKCU\Software\Acon AS\Acoustica\2.0\General\C - 15a (346 decimal)
HKCU\Software\Acon AS\Acoustica\2.0\Reverb\Cross - 1bf612d (29319469 decimal)
deleting the "C" key has no visible effect but deleting the "Cross" key
makes the prog think the evaluation period is up. restoring the original
value and then increasing it makes the ealuation period change. Increasing the
value of "Cross" actually sets the no. of days BACK??
So cross is where the "how many days left".