I know that it must look funny to you that I am having problems with Crypkey, and that too with v5.6 !!!!!

But I have been trying to unpack this prog for the past several months without much success !!!!!!!!

I had downloaded the archives of the RCE forums (the lastest zip file gives upto Nov 26 I believe) and had gone thoroughly through them...I'd also looked up the essays by Fravia, the excellent paper by Exefoliator, and several others on the net regarding Crypkey. I was interested in unpacking by myself. So I'd done a lot of research including trying to use the CKKeygen and CKinfo108.zip among others. Of course...With no sucess...Which is why I am posting here.

The prog is an exe file packed with Crypkey. No PE tools including PEiD etc give any info and Olly refuses to load it in and says it is not a valid Win32 PE file. Maybe so...Since when I actually DO run it, on Win 2000, on a Pentium 4, the prog name is not shown in the Task Manager but it runs under the DOS Virtual Machine and what is seen there is only wowexec under the ntvdm.exe or something similar in the task manager. Therefore it is pretty difficult to dump it. Imprec 1.6 is quite useless here as it claims that it is not a Win32 executable and hence refuses to get the imports when I tried to get the imports from the running app without dumping...

I had found some info on the net for patching LCRYPKYD.dll or some such file, but when I finallly found it in the App's directory, it turned out to be a 16-bit file and it really made me go nuts as to how to edit it since OLLY etc refused to load the file saying it is a 16-bit one. IDA Pro 4.3 loaded it and the GetAuthorization Module was also easily found but editing it became a problem. When I SOMEHOW tried to do calculations and changed the Hex bytes in Hex Editor, the file when put back into the Dir and when the prog was run, it said" Too big to fit into Memory" or some such thing (It was a few months ago in the initial stages so I don't remember exactly the message...)

So I changed my approach to trying to keygen the SiteKey. To that end, loaded the prog in VMware Virtual Machine (So that I could repeatedly try the various keys and just go back if the prog expired), used CKinfo v1.08 to find out as many details as possible. I used the key from the .rst file, .key file, and also the Master and User Keys got from the exe prog by disassembling it as they are stored as PlainText. Then I used the same CKinfo 1.08 prog to generate the SiteKey. Generated it successfully and input it also. The message box goes off but when I restart the prog, it again asks for the key with a different SiteCode. The prog refuses to run and just exits whether I repeat the process and give a new key or whether I press cancel.
It may be of interest to note that when I enter the SiteKey thus generated, the AUTHORIZED value stays on, the trial type changes to unlimited, and the days remaining and days used boxes go blank in the messagebox where we enter the sitekey. But the prog refuses to run thereafter. I had got the OptionLevel and the KeyLevel or something by using CK info in the manner:
CKinfo.exe /SiteKey XXXXXXX where the XXXXXXX was got from the .key file.

The prog is not crippled and is designed to run for 30 days. I had got the info about the Crypkey Ver used by CK Info 1.08 which says that v5.6 libraries of Crypkey are used. It is interesting to note that the actual file claimed to be encrypted by Crypkey according to CK info is EH.exe. But EH.exe is only 0 bytes though it exists in the dir and the actual fun which is run is RADAR8.EXE from which I'd got the User And Master Keys.

Your forum archives mention SKW.exe to generate the SiteKeys. I'd downloaded the demo from the Crypkey site itself an year ago. It was v5.7 which was downloaded at that time. If I install that Demo, I get a SKW.exe file also along with others, in the installed dir. Will it work for v5.6 also or is the SDK something else... I have a feeling it is something else and Google search did not help me...Then or now...

My attempts to keygen using CK Info 1.08 in the above manner had worked on Swish 2.0 which is also Crypkey protected... So my method I believe is not fundamentally wrong...

Can someone please point me in the right direction so that I may be able to keygen the SiteKey...

Am frustrated...Kindly please help ASAP...

Thanks in advance...

P.S. I know that you shouldn't ask for software...But the SKW.exe mentioned in the RCE archives is difficult to get hold of presently...Especially if it is not the same SKW.exe that comes with the CrypkeyDemo. I also have come across a post in the archives where a member was e-mailed the SKW.exe (If I remember right)...Any help in the direction for me to procure the SKW.exe will be greatly appreciated...Along with clues to how to patch it to generate keys for any company - This I think I can try to a large extent as there are posts in the archive on how to do the necessary patching. But procuring the SKW is a different thing altogether...

Good first post, kudos to you, you have potential. I hope you get some answers anyway...

Thanks to Delta for the encouraging comment...

I had gone back and tried patching LCRYPKYD.dll file using Hiew the way it was suggested in one of the tutorials on the web in the GetAuthorization export part of it so that it always should return Authorized to the calling function.

But immediately the prog refused to run and the messagebox said Not Authorized and in the Site Code box it says -1.

I am desperately in need of a prod in the right direction...

Thanks in advance...

Crapkey brings back memories. It's been years since I looked at it but from what I can remember and the few notes I've found, I can give you a few tips.

Unpacking the program was very easy, at least by todays standards. Note that I did this on a Win98 machine using softice. I don't think Olly had been invented yet. The unpacking routine is small and easy to follow. What you want to do is let crapkey unpack the program for you and then dump it when it reaches the real oep. From some old notes that I had the jump to oep is performed by the instruction jmp eax. As I recall this is a signature instruction. There is only one of those in the unpacker part of the program.

Once you dump the program, you'll have to realign the first section and change the oep to the real one. You can use LordPE for this. Lastly, you may or may not have a good IAT. You'll find out when you run the dumped program and receive a message about a missing dll. I don't remember if crapkey modified the IAT, but if it did, Imprec will create a new one for you.

Once you've done those steps, the crapkey wrapper will be removed from the program. Good luck.

jsteed...
The trouble seems to be that it is not a Win32 PE file at all as I already posted in my first post, and it runs under ntvdm/wowexec...

So, all the PE tools including ImpRec etc do not work there. I am going to try dumping once again under Sice under Win 98 as previously I was trying it under WinXP and failing...

Thanks anyway for the info...

BTW, I had successfully dumped/modified some other Crapkey progs like Swish , etc since they are valid PE files...

I am more comfortable in using Olly than Sice...So I'd used Olly on a similar prog which came on the same CD...The only difference being that the packed exe was a valid WinPE Win32 executable, of course, protected with crypkey 5.6.

The idea was that if I could unpack this file first, then I could try my hands on that other file also, even if be using Sice.

The problem was finding the OEP of the program. I was using olly and tried to break on GetProcAddress - The third one...
Then I tried to come into the caller prog and step until I came to a sub eax,ecx followed by a jmp eax instruction.
I am not sure whether I'd missed it but I didn't find EITHER of those instructions.

I will be very happy if you could please tell me the EXACT steps YOU'D do to get to the goal of finding the OEP.

In other words, the question is very simple... - How EXACTLY do i get the OEP of a program which is packed with Crypkey 5.6?
There is not much useful material on the net reg this point which I could follow.
And I'd spent almost 3 months researching about this Crypkey business.

I'm sure that there MUST be a simple and generic way to find the OEP of Crypkey programs...

Any guidance in this direction will be much appreciated...
Thanks....

As I said, it's been a while since I looked at this and my notes are not complete. As I recall the first thing crapkey does is unpack itself with a small loop. The entire protion of the loader that you are interested in is only 300 - 400 instructions long. There are more than 3 calls to GetProcAddress in the main loader so you may not have gone far enough.

If you follow along with the loader, the crapkey nag screen will appear. Just after this, crapkey decrypts your program using cki32?.dll. Once this is done and the program returns from this dll back to the loader, crapkey then jumps to oep.

This should give you the clues you need to find the jump to oep. Here's one more from my notes, GetModuleHandleA is called just before the call to cki32x.

Thanks for the info jsteed...

The trouble was, that the executable was not packed with Crapkey but rather was just calling functions from the library from the code. This was rightly pointed out by squidge in pm and am going to try to register the prog using the SKW.exe than patch it...

Will keep you posted...

Thanks all...

Bye

pjr :

Its good to see someone who has actually done their research rather than just asking for a crack.
I have versions 5.7 and greater of the crapkey still installed on my win98 machine so I should be able to provide some pointers.

It sounds like the program is a 16bit program so it would be best to attach to it under windows 98 as this handled 16bit applications alot better than windows XP.

It sounds like you have found the various decryption codes and the password using ckinfo.
One of the tricks with some programs is that they may use the options to determine which version is authorise i.e. Option 100 is actually version 1.00, Options 126 is for Version 1.26. This ensure clients update their license to use a new version.

Another trick is that the license code is checked after decoding to have certain flags in the code. Or there is another wrapper or extra letters are appended to the license key as another checksum authorisation.
.
It sounds like the program rechecks the license when booting and if it isn't valid it then generates a new sitecode and requests to be authorised. Therefore only the basic entry of information and checking is actually done.
When the program restarts it will call the various check license dll commands. There must be other options which are checked against the application code to ensure that the license is valid.

Peterg70

Peterg70:
Thank you very much for your reply which shows you have looked into the problem deeply...Though it took some time for you to answer

I have pmailed you... Pls check it.

Before you'd answered, squidge had given some pointers and am working on it...

Hi Friends...

Thanks to everyone who'd contributed their time and energy to this thread. Especially peterg70 and squidge, who also helped me through pm etc...
The dilemna has been finally solved !

I will just summarize the problem and the solution in a few lines for the benefit of future users who may refer to this thread.

The problem lay in the fact that the application in question did not in fact use crapkey instant wrapper but rather used the v5.6 libraries which come with the SDK. There were several calls in the program code calling functions in the crapkey libraries.

When I'd actually tried to register the application using the patched version of the SKW.exe to generate a site key for the application, I found that I could in fact register it for UNLIMITED use.
That means there was nothing wrong with the generated site key. In fact I also found that using CKinfo.exe instead of the patched SKW.exe to generate the site key gave identical results in the form of me being able to successfully register it.

However, there were SEVERAL HARD-CODED statements within the program code that actually made sure that the app was not exceeding 30 days of use after first run, and this included the app checking the time stamps of the file and some others, checking the .key , .rst and .ent files, etc.

This particular version of the prog was made for the purpose of demo and only for demo, and in fact that was why it was not possible to register it for UNLIMITED use by merely generating a valid site key. If I'd wanted the prog, then the vendors were actually going to supply me another prog with dongles etc. though even the trial version was not otherwise crippled in any way. Therefore they'd made sure that one could not register it by site keys for indefinite use by merely providing a site key, since they'd NEVER intended in the first place to give keys to allow the users to try the prog beyond 30 days...The statements for checking 30-days of use were there for that purpose.

The solution to this problem lies in ruthlessly nopping out the calls that check this 30-days or in modifying it so that it ALWAYS returns the "good" value in EAX. Of course there are several CRC checks in the prog, but these will have to be redirected as well.

The job is mostly over...And it is mostly an exercise in reversing and analyzing protections for me rather than to crack the prog and use it indefinitely... In fact, I will be probably buying the prog if I think I will be actually needing it in future. the prog will now be sitting in one of the corners of my hard disk, now that its protection is mostly analyzed and reversed.

Thanks once again to all who contributed to this thread...

Thanks pjr!

Your essay helped me a lot not trying to break the 30 day limit of radar and eh.


When reverse engineering radar.exe you will find that the kind of protection chosen is coded in the file radar.sys. By setting a special value in this file the protection will change to hasp dongle protection which is much easier to crack. You can also enable and disable options of this programm by changing some bits in the file. Of course the .sys file is protected with some checksums that have to be adjusted too. It uses some nice stealthing techniques to hide its inner structure.

Have you been successful with radar and eh demos?
Pl. tell us. I have got the demo versions with me. Your help will be of immense value to me. I have uploaded the demo radar on rapidshare.com. I can share with any one interested.

Thanks.

kpic:

Obviously you have not read our FAQ which we went to no small amount of trouble of calling to your attention with the BIG RED LETTERS on the top of the Forums on your way in. Obviously, you were so "focused" on just what you wanted/needed that you didn't pay attention to anything else and, therefore, you get to hear from me.

You obviously didn't even bother to notice that olaf posted more than 14 months ago and has not posted since!

It's time for you to go actually read our FAQ and follow our posting Rules and guidelines. We do not permit people to post links to rapidshare copies of commercial software and then ask someone to help them "crack" their target of choice.

This is a place where we expect people to be attempting to LEARN how to do such things THEMSELVES, and we expect THEM to show that THEY have actually made an effort to solve their problems "on their own" before they post a question here, seeking assistance. So far, YOU have shown no "personal effort" to accomplish what you want and YOU have not shown that you have done any personal searching on the net to attempt to determine how to accomplish YOUR goal.

Learning how to be a "reverse code engineer" is a journey and not an "instant gratification" past time. It takes the investment of substantial time and personal effort. Until you make such an effort and show that you have made that attempt, you will not find what you seek here.



Regards,