Cracking / password bypassing of "Security Setup II - Light"
	by zouzouni
	zouzouni's cracking gallery
	This tutorial is made for newbies

This tutorial doesn't have to with bypassing the security of computers using "Security Setup II - Light".

Authors words :" Security SetUp will simply disable the user's ability to access the settings (selected by you), you will be put in charge of what areas of the Windows 9X / NT setup the user can access. You decide the level of control, you can go from the extreme (E.g.. deciding thatthe user can change nothing and only access a list of specified programs / files) to the lighter levels (E.g.. the user cannot changethe desktop resolution)... "

Softice 3.25 .Read here how you can find any tool you like
Hiew or other hex editor
W32dasm893
Inctrl4 a great utility of the PC Magazine

http://www.security-setup.dk

When you run the program a nag sreen is appearing ,nag screen are so bad none of tha developers should use them the result is only annoying the customer and making him enemy not friend of the product.
Lets set our password but before that run the InCtrl4 utility (you may find this using a search engine) .This will scan the hard disk defore and after you set the password and will tell you the differences .So for the password "malakas" we have the following changes :

REGISTRY KEY VALUES ADDED: (3)
HKEY_LOCAL_MACHINE\Software\idp\PASS\SSU20 0=4603315061071513061322
HKEY_LOCAL_MACHINE\Software\idp\SSU20 EXE1P=-1031061585
HKEY_LOCAL_MACHINE\Software\Microsoft\Sdate P1EXE=RUN

WARNING :CHANGING THE REGISTRY VALUES MAY DAMAGE YOUR SYSTEM AND LOOSE ALL THE DATA OF YOUR HARD DISK.

Now imagine what will happent if we will erase the SSU20 ,EXE1P and P1EXE ,( I prefer to rename them) our system will not be anymore password protected .

2nd way of bypassing the password check :

When you enter a wrong password the message "Invalid password" is appearing .Open SECURITYSETUP2.EXE with w32asm and search for that string ,Invalid password is at two places at 44C6CE and 44C716 lets take a look what is bringing as there at those adresses ? Few lines up it says :"Referanced by a (U)nconditiolal or (C)ontitional Jump at Address 0044C667" and "Referanced by a (U)nconditional or (C)ontitional Jump at Address 0044C6C1" Those are the places where we have to set our breakpoints in softice write them in a paper 0044C667 ,0044C6C1

So start the program enter a invalid password and press Ctrl-D to enter softice set breakpoint at hmemcpy "bpx hmemcpy" this brakpoint will make as to enter in the code of the SECURITYSETUP2.EXE ,press F5 to exit softice and the OK button .Softice will break press F12 till you are in the SECURITYSETUP2.EXE code .

Now disable the breakpoint that you set "BD*" or cancer it "BC*" and set 2 new breapoints "bpx 0044C667" and "bpx 0044C6C1" and press "x" ,softice will break again at one of the 2 breakpoints is a jz (jump if no zero) at the bad message so reverse it with "r fl z" (reverse flag zero) and the program will continue like you put the correct serial . This is the correct place to patch it but the program is checking its self integrity and this is making it very difficult to patch we mast find first where the check is taking place ,but this is taking alot of time maybe one time I'll try to do it .Alteratively you may use an memory patcher.

 

The only way exept if you are a cracker )

This was an easy to crack target security systems should be more safe than this.