Reverse Code Engineering RCE CD +sandman 2000

home *** CD-ROM | disk | FTP | other *** search

/ Reverse Code Engineering RCE CD +sandman 2000 / ReverseCodeEngineeringRceCdsandman2000.iso / RCE / Library / +ORC / Orc pac 8 / HOWTO82.TXT < prev next >

Wrap

Text File | 2000-05-25 | 23.7 KB | 455 lines

HOW TO CRACK, by +ORC, A TUTORIAL --------------------------------------------------------------------------- Lesson 8.2: How to crack Windows, a deepr approach --------------------------------------------------------------------------- [SNAP95] [WINZIP] [WINCAT] -------------------------------------- SPECIAL NOTE: Please excuse the somehow "unshaven" character of the windows lessons... I'm cracking the newest Windows '95 applications right now, therefore at times I had to add "on the fly" some corrections to the older Windows 3.1 and Windows NT findings. "homines, dum docent, discunt". --------------------------------------------------------- -> 1st THING TO REMEMBER If you thought that DOS was a mess, please notice that windows 3.1 is a ghastly chaos, and windows 95 a gruesome nightmare of ill-cooked spaghetti code. Old Basic "GOTO" abominations were quite elegant in comparison with this concoction... One thing is sure: This OS will not last... it's way too messy organised, impossible to consolidate, slow and neurotic (but I must warn you... I thought exactly the same things about DOS in 1981). The most striking thing about windows 95 is that it is neither meat not fish: neither 16 nor 32... you could call it a "24 bit" operating system. We'll never damage Microsoft interests enough to compensate for this moronic situation... where you have to wait three minutes to get on screen a wordprocessor that older OS (and even old DOS) kick up in 5 seconds. I decide therefore, hic et nunc, to add an ADDENDUM to this tutorial: Addendum 1 will be dedicated to teach everybody how to crack ALL Microsoft programs that do exist on this planet. I'll write it this sommer and give it away between the "allowed" lessons. Anyway you can rely on good WINICE to crack everything, you'll find it on the web for free, I use version 1.95, cracked by [The Lexicon] (do not bother me for Warez, learn how to use the search engines on the web and fish them out yourself). Learn how to use this tool... read the whole manual! Resist the temptation to crack immediatly everything in sight... you 'll regret pretty soon that you did not wanted to learn how to use it properly. A little tip: as Winice is intended more for software developers than for crackers, we have to adapt it a little to our purposes, in order to make it even more effective: a good idea is to have in the *.DAT initialization file following lines: INIT = "CODE ON; watchd es:di; watchd ds:si;" TRA = 92 This way you'll always have the hexadecimal notation on, two very useful watch windows for passwords deprotection and enough buffer for your traces. WINDOWS 3.1. basic cracking: [ALGEBRAIC PROTECTIONS] The most used windows protections are "registration codes", these must follow a special pattern: have a "-" or a "+" in a predetermined position, have a particular number in particular position... and so on. For the program [SHEZ], for instance, the pattern is to have a 14 bytes long alphanumeric sequence containing CDCE1357 in the first 8 bytes. The second level of protection is to "connect" such a pattern to the alphanumeric contents of the NAME of the user... every user name will give a different "access key". This is the most commonly used system. As most of these protections have a "-" inside the answering code, you do not need to go through the normal cracking procedure (described in the next lesson): * load WINICE * hwnd [name_of_the_crackanda_module] * choose the window Handle of the snap, i.e, the exact "FIELD" where the code number input arrives... say 091C(2) * BMSG 091C WM_GETTEXT * Run anew * Look at the memory location(s) * Do the same for the "Username" input FIELD. (Sometimes linked, sometimes not, does not change much, though) * BPR (eventually with TRACE) on the memory locations (these will be most of the time FOUR: two NUMBERCODES and two USERNAMES). The two "mirrored" ones are the most important for your crack. At times there will be a "5th" location, where the algebraic play will go on... * Look at the code that performs algebraic manipulations on these locations and understand what it does... * Disable the routine or jump over it, or reverse it, or defeat it with your own code... there are thousand possibilities... * Reassemble everything. Uff... quite a long cracking work just to crack some miserable program... isn'there a quicker way? OF COURSE THERE IS! Actually there are quite a lot of them (see also the crack of Wincat Pro below): Look at the following code (taken from SNAP32, a screen capture utility for Windows 95, that uses a pretty recent protection scheme): XOR EBX,EBX ; make sure EBX is zeroed MOV BL, [ESI] ; load input char in BL INC ESI ; point at the next character MOV EDI,EBX ; save the input character in EDI CMP EBX,+2D ; input char is a "-" ? JZ ok_it's_a_+_or_a_- CMP EBX,+2B ; input char is a "+" ? JNZ Jesus_it's_neither_a_minus_nor_a_plus_let's_check_it :ok_it's_a_+_or_a_- XOR EBX,EBX ; EBX is zeroed MOV BL,[ESI] ; recharge BL INC ESI ; point to next char (do not check - or +) :Jesus_it's_neither_a_minus_nor_a_plus_let's_check_it XOR EBP,EBP ; zero EBP CMP DWORD PTR [boguschecker], +01 ... even if you did not read all my precedent lessons, you do not need much more explications... this is a part of the algebraic check_procedure inside the SNAP32 module... you could also get here through the usual USER!BOZOSLIVEHERE KERNEL!HMEMCPY USER!GLOBALGETATOMNAME Windows wretched and detestable APIs used for copy protections, as usual with WINICE cracking, and as described elsewhere in my tutorial. The above code is the part of the routine that checks for the presence of a "+" or a "-" inside the registration number (many protections scheme requires them at a given position, other need to jump over them). Now sit down, make yourself comfortable and sip a good Martini- Wodka (invariably very useful in order to crack... but be aware that only Moskowskaia russian Wodka and a correct "Tumball" glass will do, do not forget the lemon)... what does this "-" stuff mean for us little crackers? It means that we can search directly for the CMP EBX,+2B sequence inside any file protected with these schemes... and we'll land smack in the middle of the protection scheme! That's amazing... but you will never underrate enough the commercial programmers... the only really amazing thing is how simpleton the protectionists are! You don't believe me? Try it... you 'll get your crack at least 4 out of 5 times. Yes I know, to find this code is not yet to crack it... but for this kind of copy protection (that's the reason it is so widespread) there is no single solution... each makes a slightly different algebraic manipulation of the alphanumeric and of the numeric data. It's up to you to crack the various schemes... here you can only learn how to find them and circumvene them. I'll not give you therefore a "debug" crack solution. You'll find it yourself using my indications (see the crack of the Wincat Pro program below). WHERE ARE THE CODES? WHERE ARE THE MODIFIED FILES? WHERE DO THE PROTECTIONS KEEP COUNT OF THE PASSING DAYS? Most of the time the protection schemes use their own *.ini files in the c:\WINDOWS directory for registration purposes... at time they even use the "garbage sammler" win.ini file. Let's take as example WINZIP (versions 5 and 5.5), a very widespread program, you'll surely have one shareware copy of it somewhere between your files. In theory, winzip should be registered per post, in order to get a "NEW" copy of it, a "registered" copy. This scares most newby crackers, since if the copy you have it's not full, there is no way to crack it and make it work, unless you get the REAL stuff. The youngest among us do not realize that the production of a real "downsized" demo copy is a very expensive nightmare for the money-infatuated commercial programmers, and that therefore almost nobody does it really... nearly all "demos" and "trywares" are therefore CRIPPLED COMPLETE PROGRAMS, and not "downsized" demos, independently of what the programmers and the protectionists have written inside them. Back to Winzip... all you need, to crack winzip, is to add a few lines inside the win.ini file, under the heading [WinZip], that has already been created with the demo version, before the line with "version=5.0". I will not help you any further with this... I'll leave it to you to experiment with the correct sequences... inside win.ini you must have following sequence (these are only template to substitute for your tries inside WINICE... you'll get it, believe me): [WinZip] name=Azert Qwerty sn=######## version=5.5 The *important* thing is that this means that you DO NOT NEED to have a "new registered version" shipped to you in order to make it work, as the protectionist sellers would like you to believe. The same applies most of the time... never believe what you read in the read.me or in the registration files... This brings me to a broader question: NEVER believe the information they give you... never believe what television and/or newspapers tell you... you can be sure that the only reason they are notifying you something is to hinder you to read or understand something else... this stupid_slaves_society can only subsist if nobody thinks... if you are really interested in what is going on, real information can be gathered, but surely not through the "conventional" newspapers and/or news_agencies (and definitely NEVER through television, that's really only for the stupid slaves)... yes, some bit of information can be (laboriously) gathered... it's a cracking work, though. HOW TO CRACK INFORMATION [WHERE WHAT] * INTERNET In the middle of the hugest junk collection of the planet, some real information can be laboriously gathered if you do learn how to use well the search engines (or if you do build your ones... my spiders are doing most of the work for me... get your robots templates from "Harvest" or "Verify" and start your "spider building" activity beginning from Martijn Koster's page). As usual in our society, in the Internet the real point is exactly the same point you'll have to confront all your life long: HOW TO THROW AWAY TONS OF JUNK, HOW TO SECLUDE MYRIADS OF USELESS INFORMATION and HOW TO FISH RARE USEFUL INFORMATION, a very difficult art to learn per se. Internet offers some information, though, mainly BECAUSE it's (still) unregulated. You want a proof? You are reading it. * SOME (RARE) NEWSPAPERS. The newspaper of the real enemies, the economic powers that rule this slaves world, are paradoxically most of the time the only ones worth studying... somewhere even the real rulers have to pass each other some bits of real information. The "Neue Zuercher Zeitung", a newspaper of the Swiss industrials from Zuerich, is possibly the best "not_conformist trend analyzer" around that you can easily find (even on the web). These swissuckers do not give a shit for ideology, nor preconcerted petty ideas, the only thing they really want is to sell everywhere their ubiquitous watches and their chocolates... in order to do it, a land like Switzerland, with very high salaries and a good (and expensive) social system, must use something brilliant... they found it: a clear vision of the world... as a consequence this newspaper is very often "against" the trend of all the other medias in the world, the ones that are used only in order to tame the slaves... If the only language you know is english (poor guy) you could try your luck with the weekly "Economist"... you'll have to work a lot with it, coz it has been tailored for the "new riches" of the Tatcher disaster, but you can (at times) fish something out of it... they do a lot of idiotic propaganda, but are nevertheless compelled to write some truth. American newspapers (at least the ones you can get here in Europe) are absolute shit... one wonders where the hell do the americans hyde the real information. On the "non-capitalistic" side of information there is a spanish newspaper "El Pais" that seems to know about what's going on in South America, but it's so full of useless propaganda about irrelevant Spanish politics that it's not really worth reading. The monthly "Le Monde diplomatique" offers something too... this one exaggerates a little on the pauperistic "third world" side, but has a lot of useful information. See what you can do with all this information (or disinformation?) [BELIEVE THE COUNTRARY] Another good rule of thumb in choosing your medias is the following... if all medias around you assure, for instance, that "the Serbians are evil"... the only logical consequence is that the Serbians are not so evil at all and that "the Croats" or some other Yugoslavian shits are the real culprits. This does not mean at all that the Serbians are good, I warn you, it means only what I say: something is surely hidden behind the concerted propaganda you hear, the best reaction is to exaggerate in the other direction and believe the few bit of information that do say the countrary of the trend. This rule of thumb may be puerile, but it works somehow most of the time... if somewhere everybody writes that the commies are bad then THERE the commies must not be so bad at all and, conversely, if everybody in another place writes that the commies are all good and nice and perfect (like the Soviet propaganda did) then THERE the commies are surely not so good... it's a matter of perspective, much depends on where you are, i.e. whose interests are really at stake. There is NEVER real information in this society, only propaganda... if you still do not believe me do yourself a little experiment... just read the media description of a past event (say the Vietnam war) as written AT THE MOMENT of the event and (say) as described 10 years later. You'll quickly realize how untrustworthy all newspapers and medias are. * SEMIOTICS You'll have to study it (as soon as you can) to interpret what they let you believe, in order to get your bearings. A passing knowledge of ancient RHETORIC can help quite a lot. Rhetoric is the "Softice" debugger you need to read through the propaganda medias: concentrate on Periphrasis, Synecdoche, Antonomasia, Emphasis, Litotes and Hyperbole at the beginning... you'll later crack higher with Annominatio, Polyptoton, Isocolon and all the other lovely "figurae sententiae". Enough, back to software cracking. HOW A REGISTRATION CODE WORKS [WINCAT] Let's take as an example for the next crack, a Username- algebraic registration code, WINCAT Pro, version 3.4., a 1994 shareware program by Mart Heubel. It's a good program, pretty useful to catalogue the millions of files that you have on all your cd-roms (and to find them when you need them). The kind of protection Wincat Pro uses is the most utilized around: the username string is manipulated with particular algorithms, and the registration key will be made "ad hoc" and depends on the name_string. It's a protection incredibly easy to crack when you learn how the relevant procedures work. [WINCAT Pro] is a good choice for cracking studies, coz you can register "over your registration" one thousand times, and you can herefore try for this crack different user_names to see all the algebrical correspondences you may need to understand the protection code. In this program, when you select the option "register", you get a window where you can input your name and your registration number (that's what you would get, emailed, after registering your copy). If you load winice and do your routinely hwnd to individuate the nag window, and then breakpoint on the appropriate memory ranges you'll peep in the working of the whole bazaar (this is completely useless in order to crack these schemes, but it'll teach you a lot for higher cracking, so you better do it also with two or three other programs, even if it is a little boring): a series of routines act on the input (the name) of the user: the User_name_string (usn). First of all the usn_length will be calculated (with a REPNZ SCASB and a following STOSB). Then various routines store and move in memory the usn and the registration_number (rn) and their relative lengths. In order to compare their lengths and to check the correct alphanumeric correspondence between usn and rn, the program first uppercases the usn and strips all eventual spaces away. Here the relevant code (when you see an instruction like SUB AL,20 you should immediately realize that you are in a uppercasing routine, which is important for us, since these are mostly used for password comparisons)... here the relevant Winice unassemble and my comments: 253F:00000260 AC LODSB <- get the usn chars 253F:00000261 08C0 OR AL,AL <- check if zero 253F:00000263 740F JZ 0274 <- 0: so usn finished 253F:00000265 3C61 CMP AL,61 <- x61 is "a", man 253F:00000267 72F7 JB 0260 <- not a lower, so loop 253F:00000269 3C7A CMP AL,7A <- x7A is "z", what else? 253F:0000026B 77F3 JA 0260 <- not a lower, so loop 253F:0000026D 2C20 SUB AL,20 <- upper it if it's lower 253F:0000026F 8844FF MOV [SI-01],AL<- and hyde it away 253F:00000272 EBEC JMP 0260 <- loop to next char 253F:00000274 93 XCHG AX,BX ... The instruction MOV [SI-01],AL that you see here is important at times, coz it points to the location of the "pre-digested" usn, i.e. the usn formatted as it should be for the number comparison that will happen later. In some more complicated protection schemes the reasoning behind this formatting is the following: "Stupid cracker will never get the relation algorhitm usn <-> rn, coz he does not know that usn AND rn are slightly changed before comparing, ah ah... no direct guessing is possible". Here is only "polishing": you have to "polish" a string before comparing it in order to concede some mistakes to the legitimate user (too many spaces in the name, upper-lower case mismatch, foreign accents in the name etc.) You just need to know, for now, that this checking is usually still 5 or 6 calls ahead of the real checking (it's what we call a "green light"). You should in general realize that the real checking of the algebrical correspondence follows after a whole series of memory operations, i.e.: cancelling (and erasing) the previous (if ever) attempts; reduplicating the usn and the rn somewhere else in memory; double checking the string lengths (and saving all these values somewhere... be particularly attentive when you meet stack pointers (for instance [BP+05]): most of the programs you'll find have been written in C (what else?). C uses the stack (SS:SP) to pass parameters or to create local variables for his procedures. The passwords, in particular, are most of the time compared to data contained within the stack. If inside a protection a BP register points to the stack you have most of the time fished something... remember it pupils: it will spare you hours of useless cracking inside irrelevant routines. Back to our CATWIN: another little check is about the "minimal" length allowed for a user name, in our babe, for instance, the usn must have at least 6 chars: 230F:00003483 3D0600 CMP AX,0006 230F:00003486 730F JAE 3497 <- go to nice_name :too_short 230F:00003488 BF9245 MOV DI,4592 <- no good: short After a lot of other winicing you'll finally come across following section of the code: 2467:00000CA3 B90100 MOV CX,0001 2467:00000CA6 03F1 ADD SI,CX 2467:00000CA8 2BC1 SUB AX,CX 2467:00000CAA 7213 JB 0CBF 2467:00000CAC 40 INC AX 2467:00000CAD 368B4F04 MOV CX,SS:[BX+04] <- here 2467:00000CB1 0BC9 0R CX,CX 2467:00000CB3 7D02 JGE 0CB7 2467:00000CB5 33C9 XOR CX,CX 2467:00000CB7 3BC1 CMP AX,CX 2467:00000CB9 7606 JBE 0CC1 2467:00000CBB 8BC1 MOV AX,CX 2467:00000CBD EB02 JMP 0CC1 2467:00000CBF 33C0 XOR AX,AX 2467:00000CC1 AA STOSB <- and here 2467:00000CC2 8BC8 MOV CX,AX 2467:00000CC4 F3A4 REPZ MOVSB <- and here! 2467:00000CC6 8EDA MOV DS,DX 2467:00000CC8 FC RETF 0008 This is obviously the last part of the checking routine (I'll not delve here with the mathematical tampering of it, if you want to check its workings, by all means, go ahead, it's quite interesting, albeit such study is NOT necessary to crack these schemes). The important lines are obviously the MOV CX,SS:[BX+04], the STOSB and the REPZ MOVSB (as usual in password protection schemes, you do remember lesson 3, don't you?). You should be enough crack-able :=) by now (if you have read all the precedent lessons of my tutorial), to find out easily, with these hints, how the working of the protection goes and where dwells in memory the ECHO of the correct rn (passkey) that matches the name you typed in. Remember that in these kind of cracks the ECHO is present somewhere (90% of the cases). There are obviously one thousand way to find such ECHOs directly, without going through the verificayions routines... for instance you could also find them with a couple of well placed snap_compares, it's a "5 minutes" cracking, once you get the working of it. I leave you to find, as interesting exercise, the routine that checks for a "-" inside the rn, a very common protection element. In order to help you understand the working of the protection code in [Wincat Pro] I'll give you another hint, though: if you type "+ORC+ORC+ORC" as usn, you'll have to type 38108-37864 as rn, if you usn as usn "+ORC+ORC" then the relative rn will be 14055-87593. But these are my personal cracks... I have offered this information only to let you better explore the mathematical tampering of this specific program... you'll better see the snapping mechanism trying them out (going through the routines inside Winice) alternatively with a correct and with a false password. Do not crack Wincat with my combination! If you use a different usn than your own name to crack a program you only show that you are a miserable lamer... no better than the lamers that believe to "crack" software using huge lists of serial numbers... that is really software that they have stolen (Yeah: stolen, not cracked). You should crack your programs, not steal them... "Warez_kids" and "serial#_aficionados" are only useless zombies. I bomb them as soon as I spot them. YOU ARE (gonna be) A CRACKER! It makes a lot of a difference, believe me. Well, that's it for this lesson, reader. Not all lessons of my tutorial are on the Web. You 'll obtain the missing lessons IF AND ONLY IF you mail me back (via anon.penet.fi) with some tricks of the trade I may not know that YOU discovered. Mostly I'll actually know them already, but if they are really new you'll be given full credit, and even if they are not, should I judge that you "rediscovered" them with your work, or that you actually did good work on them, I'll send you the remaining lessons nevertheless. Your suggestions and critics on the whole crap I wrote are also welcomed. "If you give a man a crack he'll be hungry again tomorrow, but if you teach him how to crack, he'll never be hungry again" E-mail +ORC an526164@anon.penet.fi