home *** CD-ROM | disk | FTP | other *** search
/ KeyGen Studio 2002 / KeyGen_Studio_2002.iso / Tutorials / Code Inside / nh-rmcm.ZIP / nh-rmcm.txt next >
Encoding:
Text File  |  2001-05-08  |  5.8 KB  |  139 lines
  1. Re-Move Crackme by CoDe_InSiDe tutorial by nh
  2.  
  3. E-Mail: nh666@mail.ru
  4.  
  5. Need tools: Soft-Ice v4.xx, Hiew v6.xx.
  6.  
  7. So, let's see crackme in Hiew:
  8.  
  9. .004F0090: BE00114000                   mov       esi,000401100 ;" @ "
  10. .004F0095: 8BFE                         mov       edi,esi
  11. .004F0097: 33C0                         xor       eax,eax
  12. .004F0099: B930030000                   mov       ecx,000000330 ;"  0"
  13. .004F009E: 33DB                         xor       ebx,ebx
  14. .004F00A0: 33D2                         xor       edx,edx
  15. .004F00A2: AC                           lodsb
  16. .004F00A3: 01C3                         add       ebx,eax
  17. .004F00A5: 2C1F                         sub       al,01F ;""
  18. .004F00A7: 01C2                         add       edx,eax
  19. .004F00A9: AA                           stosb
  20. .004F00AA: E2F6                         loop     .0004F00A2   -------- (1)
  21. .004F00AC: 2BDA                         sub       ebx,edx
  22. .004F00AE: 93                           xchg      ebx,eax
  23. .004F00AF: 3DD01B0000                   cmp       eax,000001BD0 ;"  -"
  24. .004F00B4: 7506                         jne      .0004F00BC   -------- (2)
  25. .004F00B6: 6800114000                   push      000401100 ;" @ "
  26. .004F00BB: C3                           retn
  27.  
  28. so, file is crypted, but crypting is very easy: sub al,01fh =))
  29. so, we can uncrypt this file in hiew. we get rm-uncr.exe =)
  30. and now, change first byte by offset 4f0090 to 0cch, and set breakpoint
  31. bpint 3 (don't forget to change 0cch to 0beh it soft-ice %))
  32. trace it:
  33. yo, after some tracing, it's easily to understand that all code is executed
  34. after calling push 40000b; push xxx; retn;, so, set breakpoint to 40000a (retn)
  35. and trace...=))
  36.  
  37. .00401000: 60                           pushad
  38. .00401001: 33C0                         xor       eax,eax
  39. .00401003: 33C9                         xor       ecx,ecx
  40. .00401005: B12B                         mov       cl,02B ;"+"
  41. .00401007: BE20114000                   mov       esi,000401120 ;" @ "
  42. .0040100C: BF00004000                   mov       edi,000400000 ;" @  "
  43. .00401011: F3A4                         repe      movsb
  44. .00401013: E838000000                   call     .000401050   -------- (1)
  45. .00401018: C3                           retn
  46.  
  47.  
  48. .00401020: 680B004000                   push      00040000B ;" @  "
  49. .00401025: 68A0114000                   push      0004011A0 ;" @α"
  50. .0040102A: C3                           retn
  51.  
  52.  
  53. so, what do we see? soft-ice detecting, so, FrogsIce helps us...=))
  54. continue, and we see some interesting checks:
  55.  
  56. .00401233: FF153C004F00                 call      d,[0004F003C]  ; GetTickCount(...)
  57. .00401239: 91                           xchg      ecx,eax
  58. .0040123A: C3                           retn
  59.  
  60. .00401228: A100144000                   mov       eax,[000401400]
  61. .0040122D: 2BC8                         sub       ecx,eax
  62. .0040122F: C3                           retn
  63.  
  64. ; of course al isn't 0, but we patch byte .40122e to do sub ecx,ecx
  65. ; & that's all
  66.  
  67. .0040121D: 91                           xchg      ecx,eax
  68. .0040121E: 84C0                         test      al,al
  69. .00401220: 7506                         jne      .000401228   -------- (1)
  70. .00401222: C3                           retn
  71.  
  72. next checks:
  73.  
  74. .004010E9: 60                           pushad
  75. .004010EA: FF153C004F00                 call      d,[0004F003C] ; GetTickCount
  76. .004010F0: 93                           xchg      ebx,eax
  77. .004010F1: BF80124000                   mov       edi,000401280 ;" @└"
  78. .004010F6: 33C9                         xor       ecx,ecx
  79. .004010F8: B510                         mov       ch,010 ;"" ; hmmm....
  80. .004010FA: 803FCC                       cmp       b,[edi],0CC ;"ª"
  81. .004010FD: 7411                         je       .000401110   -------- (1)
  82. .004010FF: 47                           inc       edi
  83. .00401100: E2F8                         loop     .0004010FA   -------- (2)
  84. .00401102: FF153C004F00                 call      d,[0004F003C] ; GetTickCount
  85. .00401108: 2BC3                         sub       eax,ebx
  86. .0040110A: 84C0                         test      al,al
  87. .0040110C: 7502                         jne      .000401110   -------- (3)
  88. .0040110E: 61                           popad
  89. .0040110F: C3                           retn
  90. .00401110: 61                           popad
  91. .00401111: 68B0114000                   push      0004011B0 ;" @_"
  92. .00401116: C3                           retn
  93.  
  94. so, i think it's necessary to change mov ch,10 to mov cl,10 =)))
  95. & sub eax,ebx to sub eax,eax
  96.  
  97.  
  98. and the last check:
  99.  
  100. .00401316: 83EE05                       sub       esi,005 ;""
  101. .00401319: 8BFE                         mov       edi,esi
  102. .0040131B: 83EF10                       sub       edi,010 ;""
  103. .0040131E: 57                           push      edi
  104. .0040131F: 33C9                         xor       ecx,ecx
  105. .00401321: B11F                         mov       cl,01F ;""
  106. .00401323: F3A4                         repe      movsb
  107.  
  108. ; it this place esi=4f041f, so we patch it...
  109.  
  110. .00401325: 81FE0F014F00                 cmp       esi,0004F010F ;" Oñ"
  111. .0040132B: 7501                         jne      .00040132E   -------- (2)
  112. .0040132D: 5F                           pop       edi
  113. .0040132E: C3                           retn
  114.  
  115. after that, we get out patch file nh-rmcm.xck:
  116.  
  117. [BeginXCK]───────-───────-──────-─────────-─  ─    ─  ·  ·
  118.  ■ Description      : [W98] Re-Move Crackme by CoDe_InSiDe
  119.  ■ Crack made by    : nh
  120. [BeginCRK]───────-───────-──────-─────────-─  ─    ─  ·  ·
  121. [W98] Re-Move Crackme by CoDe_InSiDe                        made via FW by nh
  122.  
  123. Shareware limitation                
  124. RE-MOVE.EXE
  125. 000003F8: D4 D0
  126. 000003FE: 30 22
  127. 00000409: E2 DF
  128. 0000052E: E7 E8
  129. 00000627: 2E 3E
  130. 00000628: 20 23
  131.  
  132. [EndCRK]───────-───────-──────-─────────-─  ─    ─  ·  ·
  133. [EndXCK]───────-───────-──────-─────────-─  ─    ─  ·  ·
  134.  
  135. that's all
  136.  
  137. /nh
  138.  
  139.