Reverse Code Engineering RCE CD +sandman 2000

home *** CD-ROM | disk | FTP | other *** search

/ Reverse Code Engineering RCE CD +sandman 2000 / ReverseCodeEngineeringRceCdsandman2000.iso / RCE / Mendoza / ASMTUT.TXT < prev next >

Wrap

Text File | 2000-05-25 | 15.9 KB | 390 lines

Welcome to XLogic's Assembly KeyGen tutorial. What you will need: TASM 3.0 or higher (Comes with TD). A Good Text Editor (EDIT.COM). A Good Dos Debugger (I will use TD, S-ICE and DG are also Acceptable). A File access monitor (SCANF is included). An ASM Command Listing (go buy a book). A GOOD (intermediate) knowledge of ASM. <-- Don't bug me for help. X-Tract 1.51 (included). 1. Introduction. This was the first key generator I ever wrote. It taught me more about assembly than any book I've read, considering that I originally learned assembly from debugging stuff. This is a very easy keygen to do, but you use the same process to write other much more complex keygens. The best way of writing a keygen in my experience is: 1. Debug, dissasemble, do whatever is necessary to UNDERSTAND what the hell the program is doing. 2. Extract the relevant code, reverse it or whatever needs doing to make it ready for the keygen. 3. Write the keygen. 4. Use a key you made, debug the program, and make sure it works 101%. 2. Let's Get Started! Ok, look at the program, how it runs. See if it prompts for a reg number, if it looks for a key file, any way it gets registration in. With X-Tract, there are no prompts for reg numbers, or anything. Ok, so now you run a file access monitor, to check if it looks for a reg key. (I have included a good file access monitor with the package, SCANF. To make it put file access up on the screen, use "scanf con" to run it) Bingo. It looks for X-TRACT.KEY. Now the debugging starts. First create a file called X-TRACT.KEY in the same directory as X-Tract, and load your debugger. Step through with the file access montior loaded to see where it opens the key file. You trace over the following call, and the file monitor tells you that the key has been opened. cs:366B 2EA27908 mov cs:[0879],al cs:366F 9C pushf cs:3670 E8D71A call 514A Now you restart debugging and trace one instruction into that function call. You trace over the first function call, and notice that it displays the startup banner: X-TRACT (tm) Executable File Extractor Version 1.51 7-26-95 Copyright 1994-95 by Pablo Carboni. All Rights Reserved. The next block of code uses an Int 21h call. You notice that this is what opens the file. Int 21h's usage is as follows: ah = 3D ; Open file Handle for file access al = 02 ; file access code dx = filename offset ; Where the filename is in memory Int 21h ; Try to open the file jnb ok ; If the file exists, and has been opened, jump jmp error ; If the file hasn't been opened, jump. So what this block of code does is try and open the file. cs:5150 B8023D mov ax,3D02 cs:5153 BAFC21 mov dx,21FC cs:5156 CD21 int 21 cs:5158 7303 jnb 515D cs:515A E9ED00 jmp 524A Since you made a file called X-TRACT.KEY before you started debugging it should jump on the first jump. You then end up here: cs:515D 2EA3D805 mov cs:[05D8],ax cs:5161 B43F mov ah,3F cs:5163 2E8B1ED805 mov bx,cs:[05D8] cs:5168 B99B00 mov cx,009B cs:516B BABD00 mov dx,00BD cs:516E CD21 int 21 cs:5170 3D9B00 cmp ax,009B cs:5173 7303 jnb 5178 cs:5175 E9D200 jmp 524A The first line stores the files handle for future access from AX to memory location 05D8h. Now, we see another Int 21h call coming up. This time it is as follows: ah = 3Fh ; Read Data from the open filehandle in BX bx = [05D8h] ; get the file handle we saved just before. cx = 9Bh ; How many bytes we want to try and read. dx = 0BDh ; Where we want to put the read bytes. Int 21h ; Do the deed When this returns, AX will be the actual number of bytes read from the file. So what is this next piece of code doing? cs:5170 3D9B00 cmp ax,009B cs:5173 7303 jnb 5178 cs:5175 E9D200 jmp 524A Its checking if it could read 9Bh bytes from the file, and if it could, continue. As you should have noticed, if any of the previous tests have failed, they jump to location 524Ah. Keep this in mind when you are debugging the code. Now you hit this big lump of code: cs:5178 BEBD00 mov si,00BD cs:517B BF5521 mov di,2155 cs:517E B99A00 mov cx,009A cs:5181 0E push cs cs:5182 1F pop ds cs:5183 0E push cs cs:5184 07 pop es cs:5185 FC cld cs:5186 F3A6 rep cmpsb cs:5188 7403 je 518D cs:518A E9BD00 jmp 524A rep cmpsb....... hmmm, a byte-by-byte compare statement. how this is called is: cx = Number of bytes to compare DS:DI = First lot of bytes to compare ES:SI = Second lot of bytes to compare rep cmpsb ; do the compare je continue ; jump here it the same jmp error ; jump here if not the same So what should be at the start of the rego key? Whatever is at ES:DI. The other location has what was in the rego key that you created. Now you get to this: cs:518D AC lodsb cs:518E 3CE0 cmp al,E0 cs:5190 741B je 51AD And a few more with different compares. It is checking if one of these is equal to the byte it loaded from DS:DI (its there from after the 1st compare). Could it be checking for the type of registration? Lets continue and see. cs:51AD 2EA28008 mov cs:[0880],al cs:51B1 B43F mov ah,3F cs:51B3 2E8B1ED805 mov bx,cs:[05D8] cs:51B8 B92A00 mov cx,002A cs:51BB BABD00 mov dx,00BD cs:51BE CD21 int 21 cs:51C0 3D2A00 cmp ax,002A cs:51C3 7403 je 51C8 cs:51C5 E98200 jmp 524A It saves the byte it just checked to cs:880h. Then it does what it did before with Int 21h, it reads 2Ah bytes from the file to ds:00BDh. If it could read 2Ah bytes, it continues on, otherwise it quits. Now would be a good time to get out of the debugger and make the key file. 9Bh + 2Ah bytes (add the two cx vaules from the file read Int 21h's) is equal to 197 bytes, so now would be a good time to get out, make a file of size 197 bytes, With the first lot of data it compared (that string of bytes), then either a E0h, E1h, E2h or E3h, which it looked for. I will use a E0h. You've got your registration key half done. After making it, you should be able to pass all of the tests it performs to the point where we left off. If you had problems, have a look at the key that I provided called XLOGIC.REG to get some hints. Now you hit this: cs:51C8 BEBD00 mov si,00BD cs:51CB 8BFE mov di,si cs:51CD B92A00 mov cx,002A cs:51D0 2E8A1E8008 mov bl,cs:[0880] cs:51D5 AC lodsb cs:51D6 32C3 xor al,bl cs:51D8 AA stosb cs:51D9 80EB22 sub bl,22 cs:51DC E2F7 loop 51D5 Now before i tell you, try and work out what this does. Here is what it is doing: 1. si = 0BDh ;the location to start from 2. di = si ;set the second location to start from 3. cx = 2Ah ;how many times to loop 4. bl = cs:880h ;get that byte that it checked for earlier 5. lodsb ;load a byte from ES:SI into al, increment si by 1 6. xor al,bl ;xor al by bl 7. stosb ;store al to DS:DI, increment di by 1 8. sub bl,22 ;decrement bl by 22h 9. loop 5 ;loop cx times. Now, step through this, watching what this does. What does it do? It decripts the data after the 0E0h, in the keyfile, using the above process. If you can't understand this, just keep watching it and debugging it, because if you can't understand this, you won't be able to write a keygen. Now it has tried to decrypt your name, and what we're about to look at. Check this code out: cs:51DE BEBD00 mov si,00BD cs:51E1 8BFE mov di,si cs:51E3 B92800 mov cx,0028 cs:51E6 2E8A1E8008 mov bl,cs:[0880] cs:51EB 33D2 xor dx,dx cs:51ED 33C0 xor ax,ax cs:51EF AC lodsb cs:51F0 03D0 add dx,ax cs:51F2 E2FB loop 51EF cs:51F4 2E3B14 cmp dx,cs:[si] cs:51F7 7551 jne 524A Whats it doing? You should understand the first 7 lines, actually, you should understand the whole thing if you have a good grasp of Assembly. It adds all the bytes together of what "Should" be you name, into dx. Then it compares dx to the number stored at cs:si. This is what is called a CRC check. This is only a simple one, and all it does is check if any of the bytes in the string have changed. If it is the same, it is ok, and continues, otherwise it quits. Now it sets cs:2220 to 01h, to tell the program it is registered. cs:51FC 2EC606202201 mov cs:byte ptr [2220] Then it checks the 0E0h byte. This is where we find out what it does. cs:5202 2E803E8008E0 cmp cs:byte ptr [0880] cs:5208 7424 je 522E So we let it jump: cs:522E BA9B22 mov dx,229B cs:5231 E81D00 call 5251 cs:5234 C3 ret And it prints on the screen "REGISTERED VERSION". So what do the other "0E?h" values do? Go back and try the others to find out for yourself. IMPORTANT. If you don't understand all of the above, go over and over it until you do. 2. Writing The KeyGen. Now I am going to get lazy. I will tell you what the steps are, give you my commented source file, and leave you go from there. Here is what it is doing: 1. Open the Rego File. 2. Read the Header. 3. Check it. 4. Read the Rego Name and CRC. 5. Decrypt them. 6. Calculate the CRC. 7. Check the CRC. 8. Display the Rego type. 9. Continue on with the program. Here is what you have to do: 1. Read the Rego Name. 2. Calculate the CRC. 3. Encript the Rego name and CRC. 3. Store the Rego type. 4. Write the whole block (including the header) to the Rego file. Now for the assembly file: ------------------------------------------------------------------------------- .386p seg_a segment byte public use16 assume cs:seg_a, ds:seg_a org 100h xtract_keygen Proc Far start: mov dx,offset title_text ;load the startup banner call print_text ;print it on the screen mov dx,offset max_ent_length ;load the text entry offset mov ah,0Ah ;function=get text string int 21h ;get the text cmp byte ptr entry_length,01h ;check if mor than 1 ;character was entered jae short reg_type_sel ;jump if 1 or more mov dx,offset no_entry ;not enough was entered jmp short exit ;jump to exit reg_type_sel: mov dx,offset reg_type_text ;load rego type selection call print_text ;display it xor ax,ax ;clear ax int 16h ;get a char from the keybd int 29h ;display it cmp al,31h ;check if its 1 jl reg_type_sel ;jmp if lower than cmp al,34h ;check if its 4 ja reg_type_sel ;jmp if above continue: add al,0AFh ;add 0AFh to input, to get ;"E" value. mov reg_type,al ;store it in the rego type mov dl,0Ah ;1 These lines store mov dh,al ;2 the rego type mov bx,offset max_ent_length ;3 mov [bx],dx ;4 call make_key ;make the key mov dx,offset done_text ;load done text exit: call print_text ;display the output result retn ;exit to dos/windoze xtract_keygen endp print_text proc near ;put text up on the mov ah,9 ;screen int 21h retn print_text endp make_key proc near mov si,offset name_input ;this should look mov dx,si ;familiar :) mov cx,28h ; mov bl,reg_type ; xor dx,dx ; xor ax,ax ; crc_loop: ; lodsb ; add dx,ax ; loop crc_loop ; mov bx,offset checksum_dat ; mov [bx],dx ;store the crc mov si,offset name_input ;this should also look mov di,si ;familiar :) mov cx,2Ah ; mov bl,reg_type ; encription_loop: ; lodsb ; xor al,bl ; stosb ; sub bl,22h ; loop encription_loop ; mov ah,3Ch ;open the file to write mov dx,offset key_name ; int 21h ; xchg bx,ax ;put filehand in bx mov ah,40h ;write the key to disk mov dx,offset key_data ; mov cx,0C5h ; int 21h ; mov ah,3Eh ;close the file handle int 21h ; retn make_key endp title_text db 'X-Tract 1.51 Key File Generator by XLogic', 0Dh, 0Ah name_prompt db 'Enter your name: $' reg_type_text db 0Dh,0Ah,'Please Choose Registration Type:',0Dh,0Ah db '1. Registered Version',0Dh,0Ah db '2. Beta-Test Version',0Dh,0Ah db '3. Distro-Site Version',0Dh,0Ah db '4. Special Version',0Dh,0Ah db 'Enter the number corresponding to the type: $' no_entry db 0Dh,0Ah,'You must enter a name.$' done_text db 0Dh,0Ah,'Key file X-TRACT.KEY created.$' key_name db 'X-TRACT.KEY',0 reg_type db 0 key_data dd 073696854h,020736920h,072756F79h,067657220h,072747369h,06F697461h,0656B206Eh,06F662079h dd 02D582072h,043415254h,050202E54h,07361656Ch,064202C65h,06F6E206Fh,069642074h,069727473h dd 065747562h,021746920h,063280A0Dh,039312029h,062203439h,06F572079h,02C79646Fh,065754220h dd 020736F6Eh,065726941h,041202C73h,04E454752h,0414E4954h,06150202Eh,0206F6C62h,06576694Ch dd 06F532073h,06877656Dh,020657265h,054206E49h,054206568h,02E656D69h db 0Dh max_ent_length db 26h entry_length db 0 name_input db 40 dup ('$') checksum_dat db 2 dup (0) seg_a ends end start ------------------------------------------------------------------------------- Ok, there it is in all its glory. I hope you've learned something from this, and if you did, let me know. If you didn't, good for you. Tell me how to improve this tutorial. I can be contacted in #PC97 or #cracking on EFNET. Cya Round. XLogic.