Log in

View Full Version : i've cracked my first program


Rupert
June 25th, 2001, 22:56
i've got it right here:
http://axha1100.8m.com/
(swp.zip)
as you can see, it's sorta cracked. just click OK and you have all the registered functions. i'm really new to this stuff and am trying to learn. i found a newbie tutorial on how to crack this specific program, but it's for a different version. i got the basics though. look for the string "thanks for registering" and try to understand all the asm stuff before it.

i don't know what all the codes do yet. if anyone knows of a site that has something like the example below, let me know.

NOP: does nothing (no operation)
MOV: similar to LET command in QBASIC

that would really help me out. in the folder at my so called site, there is another zip. it's called tank. that's my current project. can someone take a look at it? preferably one of you grandmasters. all i want to know is if it's possible to crack. don't tell me how. if it's crackable, i'll find a way.

i'm not sure if i can crack it becuse there are no string references for "registerd" or "thanks for registering".

well, thanks for reading this.

nEOasM
June 26th, 2001, 03:02
Keep trying mann!

disease_2000
June 26th, 2001, 10:27
advice: it's ok if you don't understand asm, soon or later, you will. when i first started cracking (that
was way back) i have no clue how computer works, how it execute instruction.
what i know is ASCII (just pure ascii) and i crack program using PSEDIT (my first hex editor i've
ever used, now, hiew becomes my favorite). For simple program, you can actually destroy nag
screen with no knowledge, but for big program, it requires more understanding of how computer
go around with those instruction and with asm knowledge, it helps alot. but don't jump when
the condition is wrong.

what i mean by ASCII cracking is this: let's say that the nagscreen contains "Please Register"
you fire up any hexeditor and search for that string and then you play around with that string.
soon or later, that box will get destroyed. (this is a method that requires no asm knowledge, just
patience and it's time consuming. this is my method when i first began reverse engineer, and nailed
down 3 program in a day. 1: music program 2: screen saver 3:don't remember and that was
my first day)

so, have faith in yourself and continue with this wonderful endeavour.

one thing i forgot to add: CURIOUSITY when comes to reverse engineer, nothing is stronger than
a mind with full of curiousity. Have them, and try to destroy them with the answer you're seeking
for.

Rupert
June 26th, 2001, 12:56
i've downloaded a lot of stuff to help me learn ASM. i've made a few simple programs in debug. i got the jmp mov and am starting to learn about int.

if it possible to crack that tank game i will do it.

tell me one thing. when you open a program in dasm or whatever, do you look at the first line in there and just follow what it does or do you try to jump to where the protection acually is?

Rupert
June 26th, 2001, 15:43
this is hard to explain, cause it comes from experience. there are program that i can crack easily,
and there are program that take days and days (i don't do much cracking nowaday, i'm here just
to see what people post so i can get a better understanding of how each and every individual go
about debugging others app. that way, i will have an insight and view of debugging my own app). debugging your own app is easy, cause you're the one that actually created it and you
know what's going on in there. but debugging someone else code with no source is a task beyond
your imagination. and yet, it's possible (tools is the boundary).

whenever i decided to reverse a certain program, what i always look for first is
#1: what type of exe is it (is it 16bit or 32bit?)

that's the first thing i always look for. and do i really sit and follow instruction by instruction?

no. I will save my time by using Resources Hacker or Workshop and try to open it. See if there's
anything useful it give me. If that failed (which mean it couldn't open the exe or the exe was
unpacked by some other program.), i go for w32dasm or IDA to gain more info about my target.
(this is my first time using IDA, and i must say that it's the best! )

once i get all the info. i fire up softice and begin my work based on the research i got with dasm
and ida.

what if the program was packed by some other software? well... i'm not into that area yet. thus
this tells you that my reverse skill is not far from 50% yet. I actually stopped half way (a year
after my first day of crackign) just to learn assembly, and now, i finally understood how/what
it's all about - that's why i'm here now. and when i'm here, i feel safe. because i have a basic
understanding of asm.

i can see that you're heading the same direction i was back then. keep it up.

disease_2000
June 26th, 2001, 15:48
i think there's a bug with the login in script on this forum. the msg above is MINE. for some odd
reason, after i click the post button. It posted with "Rupert" id instead of mine. i try to exit IE
and reload my browser just to see if the problem fix, but it didn't. on the top it still say:

"logout (Ruper)" so i try to fix the problem by loging out and now, i'm back in....

and this is my msg also.

- disease_2000 <------ hope there's no misunderstood.

qferret
June 26th, 2001, 22:35
hmmmm.....How can we expoit this bug ^_^ ....just kidding }>

Argoth
June 27th, 2001, 17:10
Gratz!

I will download this tank game now and I'll have a look at it. I am also still newbie so I can't promise anything good. And my first 'crack' was that I removed a NAG from a program. I was pretty proud of that. In the beginning it didn't matter how lousy my cracks were, I just wanted to remove the irritating stuff. As soon as you have made a start, it gets more and more fun, so keep up the good work.

Grtz

Argoth

Argoth
June 27th, 2001, 17:19
And about the basic asm tut u asked for, its very basic, but will make some things clear:

http://www.worx.tmfweb.nl/ASM.txt

Rupert
June 27th, 2001, 18:07
thanks

i got a lot of info on ASM and read it. i have pretty much everything i need to understand the code. i have all the tools, and an ever expanding knowledge in ASM.

last night i traced through Winzip's entire code generator. traced it through line by line (the key gen) with softice and wrote my findings on paper.

what did i find?

Softice of Winzip32.exe: (v7.0)

408061: test eax, eax
408063: jz 004080B2

004080B2 a text ref to "sorry, wrong code". the interesting thing here is that line 408063 is different in WS32DASM

408061: test eax, eax
408063: je 004080B2

who's right? dasm or softice?

wrong password makes eax = 1. that doesn't make the JZ work. err, i need to do some more work. bye.

Rupert
June 27th, 2001, 18:21
[disease_2000 speaking here]

testing... hmmm, the bugs still exist...


Rupert, how do you know that wrong password make eax=1???

by the way, TEST changes ZF flag... according to the result.

JE Jump short if equal (ZF=1)
JZ Jump short if 0 (ZF=1)

thus, they're both right.

NOTE: MODS, please remove my account (disease_2000)
i will register with a new handle. i can see that this one is causing problem....
i don't know how i got into rupert account. i just press the reply button and i'm him.. strange.

Argoth
June 29th, 2001, 17:52
Okies, I've had a look at your Tank game. I figured some things out, but it is very hard for me. There are a lot of calculations and a lot of checks. All 'bad code' jumps seem to head for 506F:C64A. First thing: our serial should be 20 characters. The Serial is supposed to be made of the following characters: ADCEFGHJKMNPQRTWXY()3467L9$!%#@+. I don't know if you know how to use SoftICE, but I think it is necesary if you want to crack this one. Further in the code it does some calculations (which I don't understand ) and these are followed by alot of compares. it seems to work with some kind of checksum, coz when I modify my serial a little bit, the values it compares change. Maybe the skilled ppl around here could have a look at this one, coz I am a little stuck.

Grtz

Argoth

hz
June 29th, 2001, 18:40
hiya Rupert(d2k) whoever and Argoth,
if I missed anybody out (sorry). Think you will find answer to serial lengths if you check params pushed just before getdlgitem and if you check when you get to compare, note there are some obvious missing characters from the compare string. I did have a quick look then got engrossed in playing the game and forgot all about the serial :-D
regards

PS don't forget to keep an eye on that number converted to hi,lo word