Hi.

I need some expert guidance with this problem.

I am trying to crack some software. It has a license manager that, as far as I can tell, is designed by the software developers.
The package has several modules (.exe or .dll files), that are loaded when you activate choices in the program menus. So far so good.

I have been able to detect that the program can tell "authorized" or "not authorized" by reading a flag stored in the data segment: something like this:

.
.
.
mov EAX, DWORD PTR [00564560] ; ds:00564560 holds a value of Ox00000001
test EAX,EAX
jz good boy
.
.
.
bad boy



Now. Based on this, someone, somewhere in the program examines the license state and WRITES to the position ds:0056456 the value of the flag: 00000001 bad boy
00000000 good boy.

I want to detect that function to activate all modules at once.

In an attempt to pinpoint the code that sets up the flag at DS:00564560
placed a brake point in softIce like this:

BPR ds:00564560 ds:00564560+4 W.

I was hoping to catch the code that WRITES the value of the flag, to be able to identify the code that validates the license.

The problem is: IT NEVER BREAKS.

I have follwed the ds:00564560 area on the data window from the point the program starts, ( I break with BPX get version) as it loads

Initially, it is filled with question marks ??????, meaning, that area of the memory ha not been mapped yet.
eventually, as the program loads, it becomes full of data, but, despite being targetted with a BPR ( or a BPMB or BPMD etc) SoftIce does not seem to break when this critical(for me) area of memory gets wrritten with the value of the critical flag.
Any Idea why???

Thank you

Hi nobody,

Maybe it doesn't work because you're using "ds".
Try using "cs"

"BPR cs:00564560 cs:00564560+4 RW" (Maybe also include the R for Read)

Hope this helps.

Cya...

CoDe_InSiDe

Hi..
I just remembered something from one of Razzia's VB Tut..
always use the selector 30:


Suppose you want to break when
ds:<some_value> is written into,
Then always do
page ds:<some_value>
page is a soft-ice command. page will display the linear address of ds:<some_value>
then do
bpr 30:<linear_address_of_some_value> 30:....................... w

Also,
I fail to see the point in coDe_InSiDe's suggestion..
Please correct me if I am wrong..

regards
riPPadoGG

Hi nobody,
if i remember well the bpr command let sice pop only
if the addr is changed inside the context u put the bpr in
That addr should be modified from another context
and u wont catch it

Thank you for your responses.
Rippadogg: I did look for the linear Address and set the breakpoint using the "universal " selector 0030. I can definitely tell it points to the right area of memory when I do d 0030:0056......
But still no lock.

CodeInside: I tryed the selector cs: and I tryed explicitely writing the selector displayed in the data window 0187: with no positive results.

NikDH: Yes, it is plaussible that the flag gets written by some .dll in charge of security, and it uses an address context different from the program's current module address context in which I set the breakpoint. If that is the case I see few other alternatives. Question for you: Is this a documented behavoir of SoftIce or is it something you have observed/deduced?

Thanks again

Well dont know if its documented but i know the bpr command uses dr register to store the memory address u'r interested in
but the dr registers r context dependent, every time theres
task switch the dr register get changed
So the bpr method to break will work only if u can get
the right context to set bpr in

So we r quite sure that the flag is set from a context different from the one u put the bpr in, so how can another task which lives in a different context get the permission to write into an address it doesnt own ?
Perhaps using OpenProcess(), ReadProcessMemory(), WriteProcessMemory(), so try to bpx on some of them
and look for the address they wanna change
Make us know of coz

See ya
NikDH

Its me again
Now i'm registered and its much better

What i wanted to say is that u can find specifics about
the dr registers on the intel manuals

See ya
NikDH