Hi All,

Hmmm, it's pretty quiet around here lately OK, I'll give it a go.

Target: Happy Icon 2.01 960Kb
http://www.logipole.com
Any of the half dozen progams at the site would do since they all use the same principle in protections.

The Tasks range from easy, though not mundane, to very hard. So everyone should be pleased/displeased

TASK 1 - Set your system clock ahead to trigger an expiration nag.
a) Figure out how to change the install date info so the program still functions normally (at least for the next 30 days or so) WITHOUT patching the program.
b) Now patch the program so it will continue to operate (unregistered) indefinitely.

There are many API breakpoints that might, or might not, be successful with time checks. You could just try them all, or maybe use an API monitor to tell you which one(s) are being used. If not, you'll need another way to get to the relevant code. Filemon/Regmon should tell you where the install date info is kept, so you may need to use the corresponding breakpoints (i.e. CreateFileA / ReadFile for files and RegOpenKeyExA / RegQueryValueExA for the registry)

CompareFileTime
DosDateTimeToFileTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
LocalFileTimeToFileTime
SystemTimeToFileTime


TASK 2 -
a) Determine where/how the program keeps its registration info.

Trace through the registration routine and register the program by
b) patching a jump or
c) determining a valid serial.
The 1st two projects have given the general techniques sufficient to do this.

d) After you've done b) or c) above, what happens? Trace through the code (F10) and determine what API calls are used and what they are doing.


TASK 3 - Describe and/or keygen the registration algorithm. I'm not a big one on keygens, a verbal/codal description is better and probably more instructive for others. The algorithm is not *too* complicated


TASK 4 - This one's for fun. Change the image that's on the large button from a yellow "Men Working" sign to the red "Stop" sign that's in the file Resources.


BONUS TASK - Pretend at this point you don't know the exact structure of the program's licensing information. Can you re-create from first principles what is needed for the program to be validly registered? i.e. you knew where the info was kept, but not exactly what that info was. This falls under the realm of generating a registry structure/inifile/keyfile.

Task 2d) should've told you that some clues are in the exe file. This task is made even more difficult because of the presence of a CRC check which takes into account your specific user information, so maybe a combination of license reconstruction and CRC patch in the program might work.


I'll split Task1/Task2 and Task3/Task4/Bonus into seperate threads which can be used for questions/answers.

Good Luck,

Kayaker

alright, this is the way it should be

Hi Kayaker,
Don't know what happened to my last post, anyway what do you mean about crc check?. I've only had a quick look but it patched without problems. Keygen is simple, but creating a registry key is not something I've
done before (nice touch) so I will need some hints in that direction.
regards
hz

Hi hz,

The CRC check isn't on the program itself. If you patched it at the critical compare where I'm thinking of, or if you entered a valid s/n, then it "created" something which holds your registration info. Take a look at that something and there's a reference to CRC and a number. Now try changing a byte in that something and see if you're still registered

What I wanted now was for people to pretend that they didn't know what this "creation" was and could they reconstruct it from 1st principles. This would of course be the case where there is no option to enter reg info but the author sends you a little present via email after registering.

For example you see a reference in Regmon to "Name" and the result is 'Not Found'. So you create a new string reference (could be binary or dword though) called "Name", fill it in and rerun Regmon. Then that step passes and now it looks for say "Serial", so you create that one, etc. etc.

Now you've got something to break on (RegQueryValueExA) as the program starts its registration check on startup. With a file it'd be the same thing, you see it looking for a file, so create that file and enter some junk. Then you can break on CreateFileA and ReadFile and see what sort of structure it's looking for. Or sometimes the program might use GetPrivateProfileStringA if its a simple ini type file.

I'm sure you know what I mean and you've seen it before. It's sort of like registering through the back door even if you can enter a serial number through regular means. The problem is, sometimes you can't

BTW, if the program seems to hang as you're doing this (say if you don't have any breakpoints set) it just means it's trying to digest your bogus information and can't make heads or tails of it. You can just CTRL-ALT-DEL close it. But SI will break OK normally.

The other option for this Task, and maybe a better one, is just to change something, a letter or maybe the CRC value itself, and trace until you find the CRC check in the program and see if you can patch it. Yeah, maybe that's a little better and we can get an intro to CRC checks in ;d

Hope this helps,

Cya,

Kayaker

Hi Kayaker,
Don't know what happened to my last post, anyway what do you mean about crc check?. I've only had a quick look but it patched without problems. Keygen is simple, but creating a registry key is not something I've
done before (nice touch) so I will need some hints in that direction.
regards
hz

Hey, sorry this is probably a fairly trivial thing but what exactly is a CRC check?

Hi Thrax,

A CRC check is a check to make sure the program's "integrity" remains intact.

CRC (***** Redundancy Code) ***** is "Critical" I believe, but not 100% positive ;-)

At some point in the program it checks certain bytes at another part of the program to make sure they're what they are supposed to be (not patched). So if a programmer knows the weak points he can place a few CRC's in to check them and make us work a few more minutes hehe

Heh, well I guess I just jumped right in with Sice, and did the crack...And while I guess I should have studied it a bit more before going in for the kill, one thing amazed me---I just typed 'r fl z' at what i believed was *the* jump, and i was registered! Not just till I closed the box, not just till I reopened the program, but I just did that and I was registered...forever! Whats more i found the correct serial, this program uses a "cmp correctvalue,wrongvalue" sort of routine, rather than a flag of any kind, and no encrypting the correct code before comparing either...
anyway, on to actually doing what i was supposed to do

LoL!
Anyway, on to actually

Hey, seems that this project isn't quite over (for me anyway, lol) but we'res tarting another one...I think it would be cool if all the threads for HappyIcon were compiled into an essay...I understood tasks 1-4 fairly well, and learned a lot from them, but I, and I think others are having trouble on the bonus task, specifically on the part involving regenerating a keyfile from scratch...An essay would be cool I think!
If anyone wants to do this taht would be great, and I would be willing to help in any way possible (er, more specifically I would be willing to write the solutions to tasks 2 and 3 )