M4yH3M3d
October 26th, 2005, 13:50
Ok I have read most of the tuts from this site and a few other sites and this seems to never get covered so I thought I would just try to "think out of the box" for min and get a 2nd or 3rd opinion on my project. Before you read any further I am not interested in your opinion if you are going to act like a 12 year old and flame the topic nor in you "solving" this problem for me I want to do the work I just need to either verify my approach or get on the right track because I am a bit stuck.
I stopped RE'ing about 3 years ago because I burnt myself out and was involved in a community that tore each other apart more then they actually helped one another. Anyway I really did not stay up on new technologies as far as tools of the trade and new defenses available to vedors and methods of reversing those methods.
So after reading and attempting some of the cracks and things to get back into the swing of things. I am left with more questions then answers and have less time today then I did when I was younger and had less responsibilities so the time I have for this needs to efficient and productive (I know its an oxymoron having those two words used in conjunction with RE'ing).
I am currently trying to crack a program that will:
1) Load if its not verified but none of the functions from the program will work if its not verified.
2) The verification process consists of a 10 number id and 10 number/alpha pass generated (although not confirmed still working on that) off of person's name or their email address discrete math was my worst subject). Has a 30 day expiration.
a.)I actually have 3 of the id and serials for this program for reference.
b.)I also believe these are then verified by a server for which I have the ip address but have sniffed the packets (but have not analyzed), but from reading about it on a different forum they are encrypting the packets so I dont know if that would be useful anyway.
3) Code is packed (yoda v1.2) and searches for a debugger at the kernal level. Comes packed with 1 exe 2 dll's. Most of the functions or exploits are in the exe and the dll's I havent messed with yet but one is a unicows unless my memory fades me is for unicode which would make sense because the program is from asia and translated into english (if I am wrong on this flame is ok I deserve it)!
My attack so far to this point has been:
1st attack on exe:With Filemon, Procexp, apimon, open try to register with phony user id and pw. take info and load what i need into Ida debug search for clues on the process. (Just a note here I did debug the whole exe at one point to verify if it was packed and Ida confirmed there was some protection)
2nd attack was much like the same but I used a port analyzer and packet monitor to verify data being passed between program and server during verify which I could not determine 100% conclusively if it was the communicating with server that reg's hack or the game server.
Oh should be stated there is no msgbox to set a bp @ it prints a message inside txtbox of program which is used as a chat window when connected to the game the program was designed to be run in conjunction with.
Now I have a few avenues or directions to get past this but I really want to know if complicating this too much or if I am missing something here. I basically want to inject code to have this program verified all the time without the expiration being an issue and I also have to be able to patch the program later as new patches for the game are released weekly. My thought was to basically bypass the request by the program to be verified to function. Which I also have experience doing. What I have now that I didnt have before was the working id's and passwords to which have not been verified by their server yet so I basically have 2 chances to nab that process live. I am really not a network guy I understand the fundamentals of information requests between server/client but nothing near what I have seen papers written as far as cracking packet encryption and things of the sort.
Also I have been very cautious with using SI so far because I really dont have a dedicated computer to do this with that I can solely use for just this purpose which is really the tool I am most familar with out of most of these tools. In fact Ida was just getting a name for itself when I stopped modding so even after reading 5 or 6 tutorials on it I still dont feel I have a great comfort level with it. Furthermore because of the protection on the exe the information produced isnt all that hot and a nightmare to sift through.
I am pretty familar with the Windows NT/XP Server 2003 enviroment and was wondering if I was to set up SI on a separate account from the main one with as few background programs running as possible if it would be more stable? I have used the debugger that comes with my .net studio logging in off another computer I have at the house but as far as production goes my 2nd comp isnt nearly as powerful as my main comp. So because I know I can get most of what I need with SI maybe a better dasm a hex editor a unpacker and packet sniffer should I stay in that direction or would it be easier for me to just write the whole thing over and use something like trainerspy so I dont have to look for all the options and write the mod as well?
Man I feel like I have been writing forever and I didnt even plan on having this be so long but there is alot of stuff to go over. Anyway if this was your project how would you attack it based upon the info I have given. And if you need more let me know.
Just as a footnote I do not make it a habit to steal other people's work and profit off of it or anything in that nature I basically have been trying to avoid having to write my own mod because of the time I can dedicate to the process. Also the mod I am trying to re-engineer was made from code stolen from someone who no longer supports his mod and two mods were developed from this one that originally was a free mod but now both groups are charging monthy access fees to use these options (not cool) Anyway if I can get any suggestions besides the all familar "!@$##%$!#$#@ asking for advice answer" Also again, I do not want a solution just want to be able to see another way of looking at it incase I am thinking too narrowly in my processes.
And if the red signature thing pop's I DID read the FAQ's!
I stopped RE'ing about 3 years ago because I burnt myself out and was involved in a community that tore each other apart more then they actually helped one another. Anyway I really did not stay up on new technologies as far as tools of the trade and new defenses available to vedors and methods of reversing those methods.
So after reading and attempting some of the cracks and things to get back into the swing of things. I am left with more questions then answers and have less time today then I did when I was younger and had less responsibilities so the time I have for this needs to efficient and productive (I know its an oxymoron having those two words used in conjunction with RE'ing).I am currently trying to crack a program that will:
1) Load if its not verified but none of the functions from the program will work if its not verified.
2) The verification process consists of a 10 number id and 10 number/alpha pass generated (although not confirmed still working on that) off of person's name or their email address discrete math was my worst subject). Has a 30 day expiration.
a.)I actually have 3 of the id and serials for this program for reference.
b.)I also believe these are then verified by a server for which I have the ip address but have sniffed the packets (but have not analyzed), but from reading about it on a different forum they are encrypting the packets so I dont know if that would be useful anyway.
3) Code is packed (yoda v1.2) and searches for a debugger at the kernal level. Comes packed with 1 exe 2 dll's. Most of the functions or exploits are in the exe and the dll's I havent messed with yet but one is a unicows unless my memory fades me is for unicode which would make sense because the program is from asia and translated into english (if I am wrong on this flame is ok I deserve it)!
My attack so far to this point has been:
1st attack on exe:With Filemon, Procexp, apimon, open try to register with phony user id and pw. take info and load what i need into Ida debug search for clues on the process. (Just a note here I did debug the whole exe at one point to verify if it was packed and Ida confirmed there was some protection)
2nd attack was much like the same but I used a port analyzer and packet monitor to verify data being passed between program and server during verify which I could not determine 100% conclusively if it was the communicating with server that reg's hack or the game server.
Oh should be stated there is no msgbox to set a bp @ it prints a message inside txtbox of program which is used as a chat window when connected to the game the program was designed to be run in conjunction with.
Now I have a few avenues or directions to get past this but I really want to know if complicating this too much or if I am missing something here. I basically want to inject code to have this program verified all the time without the expiration being an issue and I also have to be able to patch the program later as new patches for the game are released weekly. My thought was to basically bypass the request by the program to be verified to function. Which I also have experience doing. What I have now that I didnt have before was the working id's and passwords to which have not been verified by their server yet so I basically have 2 chances to nab that process live. I am really not a network guy I understand the fundamentals of information requests between server/client but nothing near what I have seen papers written as far as cracking packet encryption and things of the sort.
Also I have been very cautious with using SI so far because I really dont have a dedicated computer to do this with that I can solely use for just this purpose which is really the tool I am most familar with out of most of these tools. In fact Ida was just getting a name for itself when I stopped modding so even after reading 5 or 6 tutorials on it I still dont feel I have a great comfort level with it. Furthermore because of the protection on the exe the information produced isnt all that hot and a nightmare to sift through.
I am pretty familar with the Windows NT/XP Server 2003 enviroment and was wondering if I was to set up SI on a separate account from the main one with as few background programs running as possible if it would be more stable? I have used the debugger that comes with my .net studio logging in off another computer I have at the house but as far as production goes my 2nd comp isnt nearly as powerful as my main comp. So because I know I can get most of what I need with SI maybe a better dasm a hex editor a unpacker and packet sniffer should I stay in that direction or would it be easier for me to just write the whole thing over and use something like trainerspy so I dont have to look for all the options and write the mod as well?
Man I feel like I have been writing forever and I didnt even plan on having this be so long but there is alot of stuff to go over. Anyway if this was your project how would you attack it based upon the info I have given. And if you need more let me know.
Just as a footnote I do not make it a habit to steal other people's work and profit off of it or anything in that nature I basically have been trying to avoid having to write my own mod because of the time I can dedicate to the process. Also the mod I am trying to re-engineer was made from code stolen from someone who no longer supports his mod and two mods were developed from this one that originally was a free mod but now both groups are charging monthy access fees to use these options (not cool) Anyway if I can get any suggestions besides the all familar "!@$##%$!#$#@ asking for advice answer" Also again, I do not want a solution just want to be able to see another way of looking at it incase I am thinking too narrowly in my processes.
And if the red signature thing pop's I DID read the FAQ's!
