May
 1999
"Winamp v2.21"
( 'How to enable the "OK" botton'  )
Win '95 PROGRAM
Win Code Reversing
 
 
by The Snake
 
 
Code Reversing For Beginners
 

 
   

Program Details
Program Name: winamp221.exe
Program Type: Multimedia utility 
Program Location: Here
Program Size: 598kb
 
 
    
Tools Used:
 Softice V3.23 - Win'95 Debugger
W32Dasm V8.93 - Win'95 Dissembler
 
 
Rating
Easy (X)  Medium (  )  Hard (    )  Pro (    )
 


Winamp v2.21
( 'How to enable the "OK" botton'  )
Written by The Snake
Introduction

The author of  Winamp v2.21 says :

 Winamp is the ultimate in media playback for 32-bit Windows platforms.
 This release includes plug-ins for MPG (audio only), MP2, MP3, WAV, MOD,
 XM, IT, S3M, VOC, CDDA, and MIDI. Winamp also supports third-party input
 plug-ins, and with them can support SID, VQF, RA, AAC, and more.
 Check www.winamp.com/plugins for plug-ins that add support for more types.
 Feel free to visit www.nullsoft.com/ for other Nullsoft projects.
 
About this protection system

 This protection routine checks the reg# within typing it, if it's not the right one, the
 'OK' botton will be disabled.
 Usually, when we want to set a bpx in Softice with "Getwindowtexta" or
 Getdlgitemtexta", we type in the name/reg# and then set a bpx in Softice and when we
 click the 'ok' botton we found ourselves in Ice.
 Here, it is going to be even easy :).  Thanks m0nSTRO.

 The program keeps its settings at the same directory that it runs from, in file called

 WINAMP.ini.

 After registering, the program keeps its settings and the registering info at :

 c:\windows\winamp.ini.
 RegisteredTo=
 
The Essay

Create a deadlist with w32dasm, and see that there is no good hint for us at the
"string referance", non of them can help us.
After you run winamp.exe and get to know where is the registering screen,
right click mouse will lead you to "nullsoft winamp/shareware/enter registration info"
Feel in the User Name and Reg#, and let try to break in SI.
press the "ctrl+d" keys to fire up Softice. Type 'bpx getdlgitemtexta' and 'x' to leave.
The only botton to push now it the 'cancel', this will take us nowhere, so DON'T.
Try to add one number to the reg# that you just typed in...  BOOM, we're in SI.
Before we go to see the assembly code, i'll just tell you that the program using
"Getdlgitemtexta"for each character of the name you typed in, and goes to generate
the reg#. Each character is beeing generated, and added to the code culculated from
all those typed before. When you type the numbers for the reg#, "Getdlgitemtexta"
is used for them too, and after each number it checks if the calculated code from the string of numbers is equal to the real reg#. If it does, the 'OK' botton will be enabled, else, keep type in numbers, and keep the botton disabled.
Okay, here is the code where we break at :

:00401F26 FFD6             call esi
:00401F28 6A00             push 00000000              ; we land here !
:00401F2A 6A00             push 00000000
:00401F2C 53               push ebx
:00401F2D 57               push edi

* Reference To: USER32.GetDlgItemInt, Ord:0103h
                                  |
:00401F2E FF1530F34300     Call dword ptr [0043F330]
:00401F34 8BF0             mov esi, eax
:00401F36 8D4580           lea eax, dword ptr [ebp-80] ; your name
:00401F39 50               push eax
:00401F3A E8623D0200       call 00425CA1 ; generates the real code
:00401F3F 3BC6             cmp eax, esi  ; eax = real esi = fake
:00401F41 59               pop ecx
:00401F42 750A             jne 00401F4E  ; if not right code, jump
:00401F44 807D8000         cmp byte ptr [ebp-80], 00
:00401F48 7404             je 00401F4E
:00401F4A 6A01             push 00000001
:00401F4C EB02             jmp 00401F50

Now, when you keep press 'F10', when you land on location 00401F3F this is the
compare between the fake reg# to the real one. Look at the eax register, the value
in eax is not a pointer to location, its the real reg# in hex, if you type now  '? eax' you will see the real reg# to register this multimedia player...
 
The Patches
 
Nothing is needed.
 

REMEMBER, i'm doing my cracks as a hobby and challenge, so please, if you like
this utility and want to keep using it, support the author and pay for it.
 
Final Notes

IWe didn't have to jump very deep in winamp assembly code, all we need was in the
same data window in softice that we break in...

My thanks and gratitude goes to:-

m0nSTRO for the idea to break within typing the reg#.

The Sandman for all what he is doing for us, newbies.

Rhayader for helping me with Reverse Code Engineering and useful tips




Essay by:           The snake
Page Created: 16th May 1999