TTFPlus 3.3 32-bit demo
A "quiver" in Visual Basic 5

by Vizion
(18 September 1997)


Courtesy of Fravia's page of reverse engineering

Well, A visual basic 5 target (without strings) with a quiver protection, very well reversed by Vizion, even if, as usual with protectionists that are NOT careful enough, you could have directly searched insie the dead listing the strings: "MSVBVM50.rtcMsgBox" and "cmp ax, 000A"

 :::: TARGET

 TTFPlus 3.3 32-bit demo (url : www.wmsoftware.com)



 :::: TOOLS 

 W32Dasm 8.9, SoftIce for NT 3.01, UltraEdit-32 4.40b



 :::: PROTECTiON

 Quiver protection (see +ORC, lesson 4.1). Internal counter. 

 The demo counts the number of times you select a font you like to see.



 :::: REMARK(s)

 You will need to change winice.dat for this crack. Open winice.dat in your

 favorite text editor and add the next line,



 EXP=:\\msvbvm50.dll



 Save the file and restart your computer if SoftIce is loaded.



 :::: FiND THE COUNTER

 Like always, I start with loading the target in W32Dasm. The first thing I

 noticed was that there were no String References. Pretty annoying if you

 ask me. If you take a look at the list of .dll files that are used you'll

 see only one :



  MSVBVM50.DLL aka. Microsoft Visual Basic Virtual Machine 5.0 (I think)



 Ok, this is quite new, and I haven't seen any tutorials on a VB5 program.

 Due to the lack of String References and the usage of only one .dll file

 we need a "new" approach to crack this baby, I suggest you sit down and

 start thinking about the way to crack this target...



 Well I came up with the following idea.



 Start the target and select several times a font, after 10x clicking you'll

 get the nag screen telling you... well read it :). The problem is that you

 need to restart the target if you want to use it some more.



 Back in W32Dasm, take a look at the imported functions from the .dll,



 Addr:0F0D3109 hint(0000) Name: __vbaStrBool

 Addr:0F01A5AE hint(0000) Name: __vbaExitProc

 Addr:0F0239B1 hint(0000) Name: __vbaFileCloseAll

 Addr:0F023FA0 hint(0000) Name: __vbaOnError

 Addr:0F04F618 hint(0000) Name: __vbaObjSet

 Addr:0F0CF404 hint(0253) Name: rtcMsgBox                    <--- interesting Addr:0F0E326C hint(0000) Name: _adj_fdiv_m16i Addr:0F023EA8 hint(0000) Name: __vbaObjSetAddref Addr:0F0E336C hint(0000) Name: _adj_fdivr_m16i Addr:0F0391DB hint(0256) Name: rtcDoEvents Addr:0F0450B1 hint(0000) Name: __vbaBoolVar Addr:0F0FDBB6 hint(0000) Name: __vbaBoolVarNull Because I didn't had any other clues what to look for, I started the target again and I fired SoftIce (SI) and I suggest you do that too. In SI (ctrl-d to enter SI) set a breakpoint on rtcMsgBox, type (in SI) : bpx rtcMsgBox If SI reports "Symbol not defined (rtcMsgBox)", read the REMARK(s) part again. Ok, exit SI (ctrl-d again), select