Hello,

I've been working on an app called Quick to-do pro v3.7 (this is the latest version, all prev versions aren't asprotected) on and off for several days. I found out about it from chameleon clock, both of these programs can work together.

The app is protected with Asprotect 1.2, recent build. Removing ASprotect was the easy part

Basically the only thing wrong is a startup nag,

I looked at it with Dede, it processed fine. Tracked the issue to the "about" procedure, which uses the "TAboutBox" form.

In the form script, I see clearly the " 'This copy of Quick To-Do PRO is licensed to:'" string.

The FormCreate procedure, however, when disassembled, reveals nothing.

Looks like this:

004C4C8C 55 push ebp
004C4C8D 8BEC mov ebp, esp
004C4C8F 6A00 push $00
004C4C91 53 push ebx
004C4C92 56 push esi
004C4C93 8BF0 mov esi, eax
004C4C95 33C0 xor eax, eax
004C4C97 55 push ebp

* Possible String Reference to: 'é½êóÿëð^[Y]ËÀU‹ì3ÀUhAML'
|
004C4C98 680E4D4C00 push $004C4D0E

***** TRY
|
004C4C9D 64FF30 push dword ptr fs:[eax]
004C4CA0 648920 mov fs:[eax], esp
004C4CA3 EB53 jmp 004C4CF8
004C4CA5 EB05 jmp 004C4CAC

here is just a bunch of garbage code. The strange thing is, these jumps skip by everything, basically down to the "FINALLY" code section.

Stepping thru it with Sice reveals nothing. I figured the actual routine might be somewhere else, like after or before this section, and figured that maybe the author confused Dede so that it displays the wrong stuff. But couldn't find anything. I have a feeling the garbage code is possibly encrypted EXE code, but it doesn't seem to ever "run" it.

Any help is appreciated

I tried looking at the whole prog with W32dasm, no luck there either. I have my doubts it does anything with the garbage code.. it doesn't seem to ever decrypt or run it, and the "unregistered copy" string is nowhere to be found either, so I deduced that somehow it has to be displaying that

?

Anyway i'm not sure but i think that the program contains strings in some crypted form (probably XORed). The thing that made me think at that was thas push xxxxxxx that address that strange data...


best regards,
.:hack3r2k:.

Thanks for the reply.. yeah, that's what I'm beginning to think.. there's something encrypted somewhere, I'm still trying to track it down.

I pasted in the whole thing, not just the start this time, if this sheds any more light.

The PUSH 4C4D0E seems to reference a jmp statement.. not sure what that means. I'm not too great at dede yet. Suspicious ref to lstnclr too at the end.


004C4C8C 55 push ebp
004C4C8D 8BEC mov ebp, esp
004C4C8F 6A00 push $00
004C4C91 53 push ebx
004C4C92 56 push esi
004C4C93 8BF0 mov esi, eax
004C4C95 33C0 xor eax, eax
004C4C97 55 push ebp

* Possible String Reference to: 'é½êóÿëð^[Y]ËÀU‹ì3ÀUhAML'
|
004C4C98 680E4D4C00 push $004C4D0E

***** TRY
|
004C4C9D 64FF30 push dword ptr fs:[eax]
004C4CA0 648920 mov fs:[eax], esp
004C4CA3 EB53 jmp 004C4CF8
004C4CA5 EB05 jmp 004C4CAC
004C4CA7 8989E9440000 mov [ecx+$44E9], ecx
004C4CAD 006A70 add [edx+$70], ch

[ clipped encrypted / obfuscated crap]

004C4CF1 5F pop edi
004C4CF2 EB04 jmp 004C4CF8
004C4CF4 EB05 jmp 004C4CFB
004C4CF6 99 cdq
004C4CF7 99 cdq
004C4CF8 33C0 xor eax, eax
004C4CFA 5A pop edx
004C4CFB 59 pop ecx
004C4CFC 59 pop ecx
004C4CFD 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '^[Y]ËÀU‹ì3ÀUhAML'
|
004C4D00 68154D4C00 push $004C4D15
004C4D05 8D45FC lea eax, [ebp-$04]

* Reference to: system.@LStrClr(String);
|
004C4D08 E8AFF0F3FF call 00403DBC
004C4D0D C3 ret

004C4D0E E9BDEAF3FF jmp 004037D0
004C4D13 EBF0 jmp 004C4D05

****** END
|
004C4D15 5E pop esi
004C4D16 5B pop ebx
004C4D17 59 pop ecx
004C4D18 5D pop ebp
004C4D19 C3 ret

Convert Double to Quad
Converts signed DWORD in EAX to a signed quad word in EDX:EAX by extending the high order bit of EAX throughout EDX

You should check first what those jumps do and also what params are pushed/what happens to them ...

hope this helps you

Someone stole my graphic I think. That is not polite !



Anyway, those references in WinDASM will happen a lot with Delphi apps, they look like junk in a disassembler always. Remember, it say's "Possible" reference. Most likely it is no reference, WinDASM is just being stupid again. That's why we have DeDe in the first place. Try to find the comparison code to *rack in DeDe before even trying to go anywhere else.

Also, you might not be finding the string because is is probably UNICODE. have you tried searching for the string in unicode mode in your hex editor? You might find it then. If DeDe found it, it's in there somewhere for sure.

Well either way it does look like you MIGHT have an encrypted string situtation. Keep working on it ! (note: it helps too if you are used to seeing exception handlers in assembly, delphi uses a LOT of them. YOu need to be able to walk the exception chain in the correct execution order to get to the right spot of where good code is actually executing. So pay attention to those mov and push [fs] 's !)

-nt20

Hi, thanks for the input. I did find the string of "This program is licensed to: " in the form script of the About Box. So it seems to be in there unencrypted.

I dug a little deeper and found out that the startup nag is actually separate form from the about fox. I looked at it but the asm code appears to be just a routine to randomize the placement of the buttons to click on the nag

I got delphi 6, so i might try playing around with writing my own prog and try debugging it with sice to see what's going on.. I'm not too familiar with what you're talking about as far as exception chain, etc..

Revisited this problem today. Solved it! I'm going to write a tutorial. This was a little complicated and different from cracking other delphi things I've seen.

There are encrypted strings! They are decrypted near the program start and copied to himem. The mangled bytes in the code I posted in messages above, does nothing.

The startup nag is easy to bypass.

There are limitations: Cannot add more than 12 tasks. I managed to track down the comparison, and fixed it.

The About fix I changed with Resource Hacker. Just deleted a label and changed another.

DeDe and W32Dasm/IDA did not help AT ALL with this cracking. Basically, there are no references to the "unregistered" strings in any of the procedures. The forms don't show anything either, except for the about box part. I had to find the decrypted strings in ram while the program was running.

Anyway it was a good challenge, and interesting obfuscation to throw off Dede (and me!)