Oct 1998 
"Mr DIZ 5.07" 
Using SmartCheck against A VB program 
Win '95 PROGRAM
Win Code Reversing
 
 
by YuGung 
 
 
Code Reversing For Beginners 
 
 
 
Program Details
Program Name: MrDizf.exe 
Program Type: file_id.diz manager 
Program Location: Here  
Program Size: 500K 
 
  
Tools Used: 
Numega Smartcheck 
Rating
Easy ( X  )  Medium (   )  Hard (    )  Pro (    ) 
There is a crack, a crack in everything. That's how the light gets in.
 

Mr DIZ 5.07
Written by YuGung
(i apologize in advance for my really poor english)
 
Introduction
 
"1 Click gets you the File_id.diz, The Zip File Listing, and Release Nfos, you can Test, clean, make text Listing,Add your Nfo files, Add your zip comment and Unzip/Move/Copy multiable files, use the Grab command to get whole drives, and all directorys. Edit the file_id.diz in multiable Zip files.Catalog all your zip files and what drives, and lots more.. A must see.. for the person with lots of zips to manage."
 
About this protection system
 
Simple scheme Reg Code, Reg Key, Reg Name. The Reg Name however is not involved in the protection. Two things make our work difficult: first (and most important) this is a VB5 program, second there are no nag screen sayng that we are not registered; just the main window caption say "REGED / NOT REGED".

There is one thing on the other hand that make our work easier: SMARTCHECK !!!!
 
 
The Essay 
 
Just checking MrDiz.Exe with the windows preview and you find that the import table use just one dll: MSVBVM50.DLL. This is for us the signature of a Visual Basic 5 program so no Debugging/Dead Listing approach.

Ok run the prog and go to the properties window, write anything you want in the Reg Code, Reg Key, Reg Name press the Apply button and you return on main window without any Nag except the caption that say you are NOT REGED.

Now it's time to exit and fire our friend Smartcheck; this program could be very useful to reverse VB programs but for a newbies could result too difficult to setup and to interpret. I invite you to read some of the beutiful essays on Fravia.org about the complete setup of Smartcheck, but for your quick reference that's the basic setup of this useful tool:

Extract from "Smartchecking VB Programs" by H2Sl on www.Fravia.org
 
After loading Target and BEFORE beginning, click on settings from the Program menu. Click on the "Reporting" tab and enable everything except "Mouse movement from OCX". Under the "File to check" tab, enable everything. Under "Error detection"  in "Type of errors to check for" check everything Check "Save settings" before exiting. When you run the program, select "Show all events" from the "View" menu as well as "Arguments" and "Sequence Numbers"

Start Smartcheck, open and then  run MrDiz directly with start command. You begin to see the program running and Smartcheck writing tons of lines, don't panic just wait (about a minute) when you get the control of target; at this moment, quickly (because Smartcheck continue to write lines after lines...) go to properties and write a Reg Number ("999" on my example) and a Reg Key ("123456789"), press apply button then return to Smartcheck and stop MrDiz running.

Now you must have a huge amount of lines (30-40000) telling to you all the steps of the target program. Save that file for future analysis (could be some mb long).

First start searching our Reg Number "999" using the toolbar search field, don't use for the moment the [Ctrl-F  menu find] option because is much more difficult to use; after some skip you must reach the following lines:
 

As we can see, the line # 31332 copy the value "Not Reged" to the string of main window caption, so the steps before must be involved in the protection. We don't find any simple comparison between our input and some regular key/code so we must use a little more brain and some good luck.
Look at the lines 31262-31302, here the prog make some operations on our Reg Number:

at line #31297 we find a new number "320679" , there 's no other reference to that number but if you divide this number by 999 the result is 321... ummmmh strange !

at line #31299 our number "320679" is multiply by 921 the result is  295345359

at line #31301 5432 is subtracted from "295345359" the result is  295339927

in next lines we don't see any more operation on our Reg Number so we can imagine that all the important operations finish at line #31301

Why don'try our last result number "295339927" as a registration key for "999" ???

Just run MrDiz and .....    MEGABOOM.  You have just registered MrDiz.

Thank you Smartcheck.
 
The Patches 
     
Simple choose a number (1-4 digits) as Reg Number, then make the following operations:

Reg Key = (Reg Number * 321 * 921) - 5432

 
If you intend on using this program beyond it's evaluation period then please BUY IT!
 
Final Notes 
    

Smartcheck could be our final tool for reversing Vb programs, try to learn how to use it and don't mind if for the first time could seem too difficult.
 
Ob Duh 
 
Do I really have to remind you all that by buying and NOT stealing the software you use will ensure that these software houses will encourage them to produce even *better* software for us to use and enjoy.

Ripping off software through serials and cracks is for lamers..
 
If your looking for cracks or serial numbers from these pages then your wasting your time, try searching elsewhere on the Web under Warze, Cracks etc.
 


 
 
 Back to Students Essay's 
 

Essay by:          YuGung
Page Created: 11th October 1998