Next version
First Version : 09/08/1998. 490 Lines.
Second Version : 09/10/1998. +750 lines
Third Version : 02/19/1999. 780 lines (just a small update, more like a bug)
Fourth Version : 02/27/1999. (who cares) lines.
after the first feedbacks, and with holidays, starting a big update.
Next Version : 02/28/1998. Between today and tomorrow is my dad's birthday (grin).
1 ) Basic things about ASM:
1.1 ) The registers:
1.2 ) the operations (or commands) in ASM
1.2.1 ) the MOV : move instruction
1.2.2) the CMP operation
1.2.3 ) the jumps operation
1.2.3.1 ) the basic jump : JMP
1.2.3.2 ) the conditional jumps : JNZ,JZ,JG,...
1.2.4 ) the call operation
1.2.5 ) other operations
1.2.5.1 ) the push & pop commands.
2 ) WinICE
2.1 ) start.
2.1.1 ) important function keys.
2.1.2 ) important commands
2.2 ) serious things
2.2.1) breakpoints.
2.2.2 ) many important notes
2.2.2.1 ) in order not to loose time in analysing Kernel32.dll
2.2.2.2 ) what program are you analysing ?
2.2.2.3 ) about the export list
2.2.2.4) About the symbol loader
2.2.2.5) Explanation about F11 and F12
3 ) Start cracking
3.1.1 ) First approach
3.1.2 ) The usual structure
3.1.3 ) Tracing
3.2 ) Key algorithms
3.3 ) More help : some real stuff
3.3.1 ) Real algorithms
3.3.1.1 ) Between theory and practise
3.3.2 ) Some "real" practise
3.4 ) Breakpoints list
I don't want to write another tut, in which you see somebody taking a prog on the internet
like winzip, puts a breakpoint, tells you : yeah , the protection is here, change that jnz
to jz, and you cracked it.
when some people ask for tutorials, I usually send them to http://www.fravia.org/
now, this url has changed to http://www.crazyboy.com/fravia/
but some came back and said : I just follow the tut, I press Enter when it says 'press enter'
but I don't see how I could do it myself.
So IF YOU'RE ONE OF THEM, THIS TUTORIAL IS FOR YOU !!!!
Even if this tutorial gets longer, read it !
this tut is not supposed to be perfect (as I'm not perfect myself), and it's not exclusive
things. ASM is the same for everybody.
So let's start from scratch:
Basically :
WHAT DO YOU NEED ?
english knowledge. asm knowledge. Softice. a brain.
and practise !
well.
First thing about cracking : take an ASM book. not a big one.
you don't have to know have to make cosinus calculus in asm to start cracking.
so buy a book, not ASM for dummies, but everybody has started with a small ASM book in his
drawer.
Second thing : get winice work on your computer. get it anywhere you want.
ask on #cracking4newbies, on EFnet IRC, for example.
Install it. restart your computer.
if you don't know what changed, press CTRL+D. you'll swap to winice, who is running
'behind' windows. press CTRL+D to swap back to the buggy OS.
you should get W32dasm89, too, but using it too quickly can bring you to be just a lamer
cracker, who's looking for schemes, and just does 1 bytes patching on conditional jump.
you think more when starting with winice. (that's how I started btw, with just one tut)
So first things about necessary knowledge (knowledge is power !)
ax, bx, cx, dx, ah, al, eax... what's all this stuff ??
a register is just a "special number" stored in the processor.
that can be used for anything :
storing a number : al=ffh ==> 255 in decimal.
storing a char : al=41h ==> the code 41h=65 is the code of 'A'
storing an adress in memory.
etc...
I don't want to explain you what is a bit. read your book for that.
UNDERSTAND that the processor just take a register as a number.
if it means a char, or an adress, the processor just takes it indifferently.
the instructions makes the difference.
we use decimal, the processor hexa, that's all. there is just a difference for the
programmer/cracker. the processor takes it has it comes.
eax is a 32bits register (a 'doubleword', or 'double')
the lower part of eax is ax, a 16 bits register ( a 'word)
ax can be decomposed in his higher and lower part, ah and al. (that are 8 bits register)
(ah and al are 'bytes'.)
so have a look
for example :
eax=654f65de
here higher part of eax=645f
you can't access to it directly
you have to do a division, for example, to access it easily
the lower part of eax is ax : 65de (=26078)
similarily, ah=65, al = de
they are not independant. modifying eax modifies al, ah, etc... and
modifying al changes ax and eax.
what's interesting in that ? well, you can be intersted in using the whole register
to make faster operation with huge numbers, and when you just need a boolean test (yes/no)
only al is needed.
NOTE : this his the consequences of the evolution of the PC.
on 8086 to 80286, eax didn't exist.
2nd note : what is said here about ax is the same for bx.
for basic operations (like moving, comparison), their role is similar.
but don't think the role of ds or eip is the same
all the registers are :
32 bits : eax, ebx, ecx, edx, eip, edi, esi, ebp, esp.
16 bits : cs, ds, ss, es, fs ,gs
the flag register. (no name)
we'll see the flag register later.
important register for starting cracking :
most : eax, ebx, ecx, edx, flag register, ] Well. I'm lying a bit
most, but with special use : edi, esi ] here. But remember that this tut
even less : ebp, esp, cs, ds, ss, es, eip ] was written for newbies.
not at all : fs, gs. ] Don't tell me I'm wrong here !
don't forget you shouldn't modify any of this register when in winice. especially cs,ds...
except if you're sure that you found where the protection is, or how it works.
1.2 ) the operations (or commands) in ASM
1.2.1 ) the MOV : move instruction
before : eax=1304EF
MOV EAX,0101FF
after : eax=0101FF
the basic operation
the type is MOV TO, FROM
the FROM isn't modified of course.
Main use :
MOV [a register], [a number]
Like shown before : mov EDX,0123DF. the number must be of the same type of the register
if you see a mov EDX,01, in fact it's a mov EDX,0000001
MOV [a register], [a register]
mov EAX,ECX. no problem. as before, you can have a mov EAX,CL or mov DH,CX
More difficult :
MOV [a register], [[a register]]
mov eax, [ecx] : it means : the processor looks at the adress stored in ecx, goes to
this adress, and read the adress as a number, that will be stored in eax
if you don't understand, type
? reg2
before executing the line
mov reg1,[reg2]
and the opposite :
MOV [[a register]], [a register]/[a number]
the processor puts the register contents/the number at the address written in the
first register.
if you don't understand, type
? reg1
after executing the line
mov [reg1],reg2
Note : you'll understand all this when you're in winice, with the register window
disabled: every time you'll execute such an instruction, winice will automatically show you
the adress pointed by the register between brackets.
DEEPER EXPLANATION :
before :
EDX=0345FD
EAX=1039456
at the adress in memory DS:EDX=DS:0345FD, you'll see 0304569 if you read it as a intel number
(the DS and the 'intel number thing' will be explained later)
so if you do a
mov EAX,[EDX]
after you'll have
EAX=0304569.
get it ? (I hope so...)
Note : you can see a mov EAX, [EDX+10]. it means
take the adress shown in the number equal to (EDX+10).
You must understand that : EDX,ECX,etc... are 32 bits number
it means they can go from 0 to FFFFFFFF. (4294967295)
the operation of comparison which is linked to the jumps comparison (see later)
CMP [a register], [a number],CMP [a register], [a register],CMP [a register], [[a register]]
it's easily understandable if you understood all the MOV operation.
note that none of the parameters (first or second are modified)
as before, cmp eax,ch is impossible. the same type is required on each 'side'.
So we'll start directly with the next operation to understand better the use of the CMP
1.2.3.1 ) the basic jump : JMP
JMP [a register]
JMP [a number]
the next operation that will be executed is at the adress CS:[register] or CS:[Number].
(like 'DS:', 'CS:' will be explained (perhaps) later)
1.2.3.2 ) the conditional jumps : JNZ,JZ,JG,...
This are the most important for cracking : the test if your serial is good or not, for example.
do you understand ?
well: the scheme is like this
a comparison
the 'result' is stored in the FLAG REGISTER
A conditional jump
First : the flag register is a register without name.
all of his bits are taken separately. they all have a name. you can see them in winice under
ESI=.
o d i s z a p c you can count : 8 bits. it's a 8 bit register.
if one of them is in uppercase (Z, not z), it means the flag is on.
So what about the flag register.
Imagine a simple protection : just one serial. it must be 123456 (01E240 in hex)
EAX contains the number you entered.
there will be a comparison with 01E240, like this
CMP EAX,01E240
JNZ xxxxx
understand : the computer execute the cmp operation. flags will be changed. especially ZF/Z
the Zero Flag.
in fact, the processor will do a substract. if the result is zero (it means EAX=01240), the zero
flag will be on. if not, it will be changed to off.
JNZ means Jump if Not Zero : jump if the Z flag is off
JZ means Jump if Zero : jump if the Z flag is off.
but you'll don't have to think about the flag : just look at the value in eax, and
JNZ will actually jump if eax is different from 01E240.
(I hope my explanations are enough)
perhaps don't think too much about the flag. you can see Winice tell you if the jump will be
really effective. swithc Z to z to see the change (there are CMP ... JNZ everywhere).
other important jumps :
JG,JGE ... : Jump if greater, if greater or equal... (easy to understand. just read your book)
used for calling a set of operation, then come back.
basically, the next operation will be at the address pointed by the operand
(in front of the call), and it will come back with a RET.
example :
address operations steps
001 : MOV AX,10 1
002 : CALL 004 2
003 : JMP 006 5
004 : MOV AX,9 3
005 : RET 4
006 : MOV BX,AX 6
it's a strange structure, just to explain you its interest.
ADD, MULT, etc...
I talked about the basic instructions, go on with your book.
take w32dasm, disasm any small Window EXE, and look at the instructions you should understand.
for example : ADD, INC, DEC, MULT, REPZ,REPNZ,TEST,push, pop,jumps,
and logical operation : AND, OR,XOR, NOT
1.2.5.1 ) the push & pop commands.
when you see a push eax, you'll have to think that the value of eax is stored somewhere (in the stack)
and with pop eax, the last value stored by a push is written in eax, and removed from
it's storage place
for example :
mov eax, 10
push eax
mov eax, 20
pop eax
(eax=10 now)
or
mov eax,10
mov edx,20
push eax
push edx
mov eax,0
pop eax
(here eax=20)
pop eax
(here eax=10)
If you don't understand , read books !
but the most important thing about push is the way to send parameters
ex : I want to use a function to test a serial
a sort of
boolean : function is_serialgood(serial_entered)
you'll see sthg like this :
push [address of serial entered]
call xxxx (mydll!is_serialgood)
so when you start cracking ,you must see push as a 'perhaps my serial is here'.
when you see a
Push register
do a "d register".
if you see your serial in the memory dump window, it should be good.
End of this first part : don't forget to read your book, and/or other tuts.
try to imagine how things work. and when you know how to use winice, explore any prog.
What is it ? the best debugger on earth for Win95/98 (didn't test it on 98)
The best, the great WinICE.
How to use it
Install it, press Ctrl+d (you should be in winice then), press Ctrl+F1 for a better view,
type
'faults off' enter
'wl' enter.
F2
Ok
now you're in winice.
you see all the register in the upper part. with the register flags, as I told you,
under ESI=.
you see the memory dump under the register. it's just the content of the memory, at any
adress
you see the code under the memory dump. it's where the instructions to be executed are shown.
the highlighted instruction is the current one.
and under the code, the place where you enter orders.
2.1.1 ) important function keys.
basic :
F1 = Help. like typing 'help' in the command line
F2 = switch on off register windows. useful when you see a mov ax,[cx] and when you want to
quickly see what's on cx adress.
F4 = see the output (windows) . any key to swith back to WI. note : the execution is halted
when pressing F4 : it's just 'a snapshote'.
F5 = like pressing ctrl+D, it switches back to W95. the execution is resumed, with WI running
behind of course.
F6 = when you're not in the dump memory windows, switches between code and command windows.
'advanced' function keys :
F7 = go to the code window, put the cursor on an instruction under the current (highlighted one)
instruction, press F7 : it means 'goto here'. all the instructions are executed until this
line is reached.
F8 = trace into : means one step instruction, including go 'into' a call instruction (see F10)
F9 = in the code windows : set a breakpoint on the instruction on/off.
F10 = step over : means one step instruction, skipping call. (see F8)
F11 = See here
F12 = See here
don't forget to use the help command.
try to use it before saying that you don't understand.
Of course, these functions can be changed, via the initialization settings of Winice. check the FKEY command in Softice help
r = makes it possible to modify registers
d [an adress] = makes the memory dump show you the [adress] adress ( :) ).
e = edit memory
s = search in memory
if you want to search 'Your name' in memory type
s 0 l FFFFFFFF 'Your name'
don't forget the zero, the l (L) and the eight 'F' before to do a full search
u can use the mouse too.
a breakpoint is something that will say to winice : stop here. and w8t
example for explanation : you enter a name, when you want to stop the program when it reads
the name you entered (to see what's he's doing later)
then type
bpx getdlgitemtexta (for example)
it will make WI stop when this windows command will be executed.
the first thing to do for cracking is entering the program, as closest as the "serialcheck"
as possible.
so the breakpoint is the starting point of the cracking.
they are different kinds of breakpoints
most useful ones :
BPX : breakpoint on execution. when a adress get executed
BPM : breakpoint on memory. when an adress is read or written.
see 3.4 too...
2.2.2.1 ) in order not to loose time in analysing Kernel32.dll
when you use bpx [the name of a windows function]
you'll stop at the beginning of this function (perhaps in the Kernel32.dll).
unless you want to analyse the whole windows, press F12. it will makes you out of the
windows DLL. see F11 and F12 later.
2.2.2.2 ) what program are you analysing ?
in winice, at the bottom, on the left, you see the task you're studying.
if you see 'the shareware I want to crack', it's good.
if you see 'explorer' or 'kernel32' perhaps you made a mistake.
imagine. several tasks are running. explorer, winamp, AVP antivirus, etc... (i don't know)
if you press Ctrl+d at anytime, perhaps winamp was currently executed, etc...
so you should know that in fact you're not in your 'tobecracked' program.
good advice : close as many apps as possible. winice will break on any task if you asked to
break on a too basic function. it won't make a difference between the target and winamp, for
example.
moreover, when your task is calling a windows functions, the instructions executed will belong
to a windows DLL. you can see the "current file you're in" between the code and the command
windows.
to conclude, if you see kernel32/user/user32/gdi/VMM between the code and the commands windows
you're not currently in front of a code you're likely to analyse (if you're reading this tut).
so when you enter such a dll, try to get out as soon as possible (press F10, not F8 !)
similarily, when you're in your prog, you see a
call USER!Dlgitemtexta
press F10 to go over it.
Hint : unload as many apps as possible. they could make WI break, at unwanted points.
2.2.2.3 ) about the export list
I talked about call USER!Dlgitemtexta. what is it ?
if you see softice initialisation settings in the symbol loader
there is the export dll section : what is it ?
first : a dll like the exported one is a set of function called by programs (for example for
reading a registry key)
if you don't put a dll like kernel32.dll in the export list, look what it can do
not in the export list in the export list
call xxxxxxxx call kernel32!hmemcpy
here hmemcpy is a function contained in the kernel32.dll file.
so if you don't put a dll like this in the export list, perhaps you'll execute a call, and land
in the middle of an unuseful dll. you should have pressed F10 to skip the call.
but if you did put it, winice will recognize the call as a call to this function
and will show you the name instead of an adress.
I'm sure you'll see what's happening.
the task is still your shareware (in the bottom right) but a function of kernel32.dll is called
so the current file showed in the code (between the command and the codewindows) is kernel32
.
2.2.2.4) About the symbol loader
except for the export dll list, the symbol loader is useless for a beginner.
Prophecy adds that it's useful anyway, if you want to break when the program starts loading.
for example, when a second check is carried out when restarting (classic : the prog says "good
serial, I will restart now", and then , SECOND CHECK)
open the symbol loader
go to file=>open. select the EXE of the prog
then press CTRL-L
symbol loader will break on entry point of prog
2.2.2.5) Explanation about F11 and F12
when do I use them ?
F11 : you set a breakpoint on a function (getdlgitemtexta for example) and winice is just at
the beginning of this function. as you don't want to study it (I think), Press F11.
You'll go out of the function directly. but don't press any other key like F8 or F10.
directly press F11.
F12 : you are in the middle of a function you don't want to study.
example : if you set a breakpoint on hmemcpy, when winice wil break,press F11 (as I said
before). but since Hmemcpy as been called by a Windows DLL (usually), and you want to
get out of it, press F12.
in other words, press F12 to do the same as F11, but this one works when you're not
just at the beginning of a function
What do they do really ?
F11 : when a function is called, the info for coming back (with a RET) to the instruction after
the CALL command are stored in memory. if nothing is changed, WI can use them to go
to this instruction
F12 : this key tells WI to step over (not going into calls) all instructions until it founds
a RET.
F11 Example:
you typed BPX GETDLGITEMTEXTA
the code is like this
xxxxx
.......
call XXXX!GETDLGITEMTEXTA
<-- F11 will bring you here if you pressed it after the break
F12 Example (from Prophecy)
some ASM <- You're here, and press F12
MORE ASM
CALL xxxx (calls are not explored , even if there is a RET at the end of the called part)
etc.... (no RET)
RET
<next instruction> <- SI breaks here
take a shareware, that you can reg with a serial.
use techfacts to see if this prog is made in vb : if techfacts (or dllshow) tells you this
program is using VBRUNXXX.dll or MSVB*.DLL, take another prog
first step : setting a breakpoint
go in the 'register' dialog.
switch to winice (ctrl+d)
you want to set a breakpoint on [read the text I've entered] ?
so it should be one of this function
getdlgitemtexta, getwindowtexta (the most often)
do a "bpx getdlgitemtexta" enter
"bpx getwindowtexta"
if winice tells you "symbol not defined" then you should put dll's in the export section of
winice and reboot (see note 2.2.2.3))
press F5/ctrl+d to go back to your shareware
type your name, your serial
press enter
I hope WI will popup
you *should* be at the beginning of getdlgitemtexta (or the other one)
press F11 to go back to your prog
now, in your prog, investigate. don't hesitate to use
d [an adress or a register]
to see what's going on.
SO :
after breakpointing, and coming back to your shareware :
disable the breakpoints on the get** functions with the "bd" command
and then two main ways :
do a search on your name / serial : so don't enter sthg like '123456'. and bpm
on the adress given
ex :
- s 0 l fffffffff 'My serial'
Pattern found at xxxx:yyyyyyyyyy
- bpm xxxx:yyyyyyyyyy
then press F5
when it breaks, explore.
or use F8/F10 to explore straight on, and try to see what's going on
Note : the basic/essential/simple/plain scheme of a serial check
push xxxx (on a "d xxxx", you see your serial in memory dump)
call aaaaa:bbbbbbb
test eax,eax
jnz adress2 (not good)
... (good)
...
in most cases :
/ the program generates a serial with your name, and compares it with the serial entered.
/ the program generates a number with the name, then generates a 2nd number with the serial you entered,
and compares both numbers.
if you want to patch, change the jnz to jz with an Hexeditor...
(download Hexworkshop : serial MK121212. it's a serial easy to remember : last mortal kombat game)
if you want to make a keymaker, start analysing the call.
Note : a keymaker is far more interesting. And the pride is bigger when you make a keymaker.
It always look more magic.
That's why I'll add a few more stuff for understanding serials, there nothing to add if
you just want to patch.
For starting, check here
Now, I assume that your target is pretty easy, that you used a suitable breakpoints.
and you can use trace into the registration procedure as much as you want
(i.e : the program won't hang after 3 checks).
Here is how you should behave
Don't hesitate to type "d <register>" many times.
When you see a call, and you don't want to trace into it
put a breakpoint before (don't forget to delete old breakpoints)
check what parameters are passed (push...), and see what the result is (using "d" again).
If the call seems to be very important, just press F5, and reenter a serial,
then trace into the call instead of stepping over it.
For example, that will avoid you stupid waste of time : imagine that.
push eax
call XXXXX
mov [ebp-8],eax
if I do "d eax" before the call : you see "Crashtest" in memory
and if eax = 9 after the call, then it's (99% sure) a string length calculation.
I know it now. I haven't analysed it. I saved time for some further analyse.
Of course, a string length calculation is easy to spot. But sometimes, usual
manipulation are done in an odd way. I remember, in my second crack (a keygen)
having spent 30 minutes on a very weird decimal-to-hex procedure.
And this way, step by step, you'll see what checks are done, on the serial.
If you see that the program ask for a 10 chars serial, put a breakpoint. remove all others
press F5. Change the serial. And just restart where you stopped.
When I started cracking (my first crack was a keymaker for Jigsaw 2.0), I wondered what it could be ?
I wondered : will it be a matter of square roots, prime numbers... etc...
No ! ... not at all !! (in most sharewares)
Here is what you can/should expect from a serial generation (not a tough one, but all these
techniques put altogether can make something long anyway)
I'm talking here about a protection in which you enter you name and a serial.
First :
* check of the name entered
- check of it's length. of the number of words (when a full name is asked, for example)
* check of the serial entered (more important here)
- length, correct chars (digits or letters, a '-' at the good place)
* manipulation of the name
- elimination of unwanted chars (ACDSee for example), change to uppercase chars
- the name is filled with chars to gain a special length
(in CS1Xedit, for example, if the name is <32 chars, the missing chars are filled with '!').
* then the calculus itself. what's usual in sharewares.
SWITCH
First char is switched with the 11th one, etc...
(Winplay)
TRANSLATION TABLES
'A' becomes 'C', 'B' becomes 'Z', etc...
it can be used several times
(Multidesk, and many many others...)
some sharewares just change your name. for example :
Name : Crashtest
Serial : Dsbtiuftu
you see ? C => D, r=>s.
I have never seen sharewares with such stupid algo, but some are very close.
THE XOR TRICKS:
the simple xor trick : if A xor B=C , then C xor B=A
you can go back to A easily
you just have to check what the B number is.
Beware : perhaps it won't be the same all the time !
1st char xor 11, 2nd char xor 12...
the advanced xor trick
for this one , the previous 'modified' char is used with the next char
Example :
modified_name_First_char = Original_name_first_char XOR a_certain_number
modified_name_second_char = Modified_name_first_char XOR original_name_second_char
modified_name_third_char = Modified_name_third_char XOR original_name_third_char
....
you get it ?
now, the problem is to reverse the algo (as usual for a keymaker)...
well... you do the same thing exactly once again, but in the reverse direction. start at the end
but this is not direct. Try before !
USE OF THE SIZE
this one is very simple
for example
serial = Number1 + Size * number 2
(used in GBCS softwares)
or the size can be used in another way
USE OF EACH CHARACTER CODE
you remember ? 'A'=65, 'B'=66, etc...
they can be used in many way.
OTHER ADVICE :
there are many different ways to convert to hexa from decimal, or to take numbers from a string
and calculate the resulting number.
so if you're new to cracking , sometimes you can avoid problem if you just look at the registers.
but the most important is to understand what's happening. If you haven't understand what's
really happening, the reversing will be nearly impossible.
Many checks are possible. BEWARE : The prog can say you : registered, and then... it hangs.
The new trend in software protection is to change the check from a version to another, but
with more checks added.
example : use a 3.1 generated serial in version 3.2 of getright, and you'll have a
message later telling you this serial is pirated.
I say "trend" because it's used more and more. (that's nice, it means more work for us !)
only Winzip hasn't changed since version 4 (if you know a winzip 1 send me plz))
for example :
MP3Wolf, XWolf, ...Wolf, Getright, ADC, Keytext, BulletprofFTP, CDRWin,Virtual Turntable,etc...
3.3 ) More help : some real stuff
Well, you wonder ... is all that rubbish, or is it true ?
I give you some REAL algorithm, taken from REAL shareware.
Ultraedit32 (old version, 2.XX I think)
N=name length
S=sum of all the name's characters code
Serial=64*S*S+N*N
CDWizzard 4
(you enter a name, it gives a key, then enter the password)
Password=11/7*key (rounded, since word are used)
WinPGP (1.XX version, I think)
S=sum of all the name's characters code
serial = (S+32)*196618
Jigsaw 2
Serial:=51659;
for (all name's chars) do Serial=2*Serial+Nth_char_code;
serial for 'A' is 37847, for 'B' is 37848
3.3.1.1 ) Between theory and practise
This is between the algos and real practice.
I could have put it in the algos section, but I analysed that today, so I'll bring you more
information. The program is Pronounce (old, 97)
It's a simple example. but it's a real protection. that will still block
100% of non cracking people. and note that serial fishing is not possible, here.
The prog asks a reg code. it gives you an ID code.
after finding out where the check is :
014F:00406788 MOV ECX,ESI ] Parameters stored in ECX 014F:0040678A CALL 004067D0 ] a Call is processed 014F:0040678F TEST EAX,EAX ] a test is made 014F:00406791 JZ 004067A4 ] a conditional jump occurs 014F:00406793 CMP DWORD PTR [ESI+6C],00 014F:00406797 JNZ 004067B2 014F:00406799 PUSH FF 014F:0040679B PUSH 00After further tracing, we notice that jumping to 4067A4 shows :
Now see what's inside the CALL 004067D0.
ESI contains the ID code. u have to enter a reg code, which is in EAX
014F:004067F8 CMP ESI,05F5E100 014F:004067FE JB 00406819 014F:00406800 AND ESI,555577FF 014F:00406806 ADD ESI,ESI 014F:00406808 CMP EAX,ESI 014F:0040680A JNZ 00406819 014F:0040680C MOV EAX,00000001 014F:00406811 POP EDI 014F:00406812 POP ESI 014F:00406813 ADD ESP,04 014F:00406816 RET 0004 014F:00406819 XOR EAX,EAX 014F:0040681B POP EDI 014F:0040681C POP ESI 014F:0040681D ADD ESP,04 014F:00406820 RET 0004 look: 014F:0040680C MOV EAX,00000001 014F:00406819 XOR EAX,EAX (ie EAX = 0) it shows that the result of the call is either 0 or 1 (it's a boolean) it's exactly what we see here : 014F:0040678F TEST EAX,EAX the prog tests if EAX = 0 so any jump to "014F:00406819 XOR EAX,EAX" means the serial is wrongwe can see 2 conditional jumps the 406819
014F:004067F8 CMP ESI,05F5E100 014F:004067FE JB 00406819that means : jump if ESI is below 05F5E100. i.e : the ID (the number given by the program) must be under 100000000
the second one (just after): 014F:00406800 AND ESI,555577FF 014F:00406806 ADD ESI,ESI 014F:00406808 CMP EAX,ESI 014F:0040680A JNZ 00406819It does some operation on ESI. then compares the result with EAX.
So : to sum up :
the program gives you an ID number, x.
you must enter 2*(x and 555577FF) as a reg number.
This algo is very simple. but nobody can find it by luck (1 chance out of 100000000).
And serial fishing is not possible, as the ID depends on your computer.
I hope that all of you understand that it may be very easy. It's just a matter of time.
Well. Obviously, this link makes this tut like all other, you could say.
Whatever, I'm still trying to provide as much help as possible.
Jump there for my Winamp real practice tutorial.
For a standard protection, you have basically 2 solutions :
breaking when the program reads your serial, or when the program tells you that the serial number is wrong.
First category:
reading the serial :
GETDLGITEMTEXT (16 bit EXE-target)
GETWINDOWTEXT ("" """)
GETDLGITEMTEXTA (32 bit EXE-target)
GETWINDOWTEXTA ("" "")
etc... see GETDLGITEMINT too.
if you don't want to bother, or
if it doesn't work, use this one ! HMEMCPY
coz all this GET... stuff will call HMEMCPY. so I always use it.
usually, you have to press F12 to get back in the program several times.
like 10 times, for instance.
Check here for a better example.
Second category:
Message boxes :
MESSAGEBOX (16b)
MESSAGEBOXA
MESSAGEBOXEXA
MESSAGEBEEP
of course, it's a shortlist here. but good for starting.
Don't forget the first crack is long... VERY LONG...
and it's always longer (in most case) than what you expected...
and anyway, a too easy protection makes you hungry. while a tough one makes you better !
but when you finished (especially something that looks magic like a keymaker...)
You'll feel... proud, and happy... (like shouting , bouncing, dancing)
and don't forget : keymaker (when possible of course) are better than simple cracks.
Why won't I translate this tutorial in French ?
because I tried, and I can't help writing jokes in French.
While writing English makes me serious. so :
Pour les blagues, c'est pas l'idéal de lire un tutoriel sur le cracking.
Désolé, les gars.
I thank all the people that helped me for this tutorial, and all the people who tought me how to crack.
Thanks to HarvestR,Iczelion and others for hosting this tutorial. (Spreading the knowledge is important !)
Thanks to all for their feedbacks.
Thanks to Cafein for always backing me. (ka-no-joo !)
Greets to :
All my tNO friends. all former tNO members.
CIA, Core, DS, HS, TRPS, #cracks and #c4n (etc...) friends
all my REAL LIFE (?) friends.
all crackers.
Crashtest [tNO '99]
Of course, I won't accept any request.
Catch me on #cracking4newbies, on EFNet