//**cracking tut by alpine**// //*****and******// //**the immortal descendants**// #4 05.1999 hello and welcome to a new adventure.... Target today is powerzip with its lazy protection scheme.For expirienced crackers,this protection scheme wouldn't make a lot of troubles.Therefore this essay is for beginners. what we need: pzip //download it from www.cnet.com or www.powerzip.lco.net softice wdasm or pc_offset to get the opcodes. hex editor of your choice. lets fetz(g.l.) Regarding our target we can find a box to register the program,when we click on about/register.Probably you have noticed the time trail protection,but i'm not cracking it today,because using the program longer than 30 days doesn't cause anything. Now enter a name and a fake serial, i used alpine and 1234565. Press register and you get a messagebox telling you to f**k off. Click on okay and then enter softice.Set a breakpoint on hmemcpy. //i almost always use hmemcpy,because it works for nearly every target// Exit softice and press register,you will be kicked back to softice. Now you have to press f12 till you reach the main exe file.By pressing f12 once again you will be in a windows dll,therefore press f12 once again and you will find yourself back to the main exe. Now we are close to our protection scheme. what i do, to find the compare routine is to press f10, till i get the annoying messagebox,telling me: wrong serial. You did it? you wrote down the call,which triggered the messagebox? Ok, then set a bpx on hmemcpy again and trace till are at the following adress,marked with *1 :0041211D E830020100 Call 00422352 :00412122 3D14513035 cmp eax, 35305114 *1 :00412127 7507 jne 00412130 :00412129 B81E513035 mov eax, 3530511E :0041212E EB0C jmp 0041213C :00412130 3D8883FF1F cmp eax, 1FFF8388 :00412135 7505 jne 0041213C :00412137 B89283FF1F mov eax, 1FFF8392 :0041213C 8B4F64 mov ecx, dword ptr [edi+64] *2 :0041213F 81F914513035 cmp ecx, 35305114 *3 :00412145 741C je 00412163 :00412147 81F98883FF1F cmp ecx, 1FFF8388 *4 :0041214D 7414 je 00412163 :0041214F 3BC8 cmp ecx, eax *5 :00412151 7410 je 00412163 :00412153 6A00 push 00000000 :00412155 6A10 push 00000010 :00412157 686C274300 push 0043276C *6 :0041215C E861F90000 Call 00421AC2 *7 Now what happens?: *2 our fake serial number is moved to ecx. *3 our number is compared to a real "static" serial number. *4 the same as above. *5 it is compared to eax.In eax the real serial number,generated on our name, is stored. Now you will say,by typing d ecx i can't see my serial. Try to do a ? ecx and you will get your fake serial.Since our number is compared to two serial numbers which are always the same (*3,*4),you will have to do the same to see the two serial.For example at *3 do a ? 35305114 and you will get one right serial.At *5 do a ?eax and you will get the real serial based upon our name. That's it..... alpine alpine@gmx.at thanks to the immortal descendants ft-Ice. Set a breakpoint on GetDlgItemTextA (BPX GETDLGITEMTEXTA). Press Cntrl+D to exit back to DocMan and click the "Unlock" button. Soft-Ice will pop up on the breakpoint. Press F-11 once to get into the routine, and you'll land in the following code: --------------------------------------------------------------------------------------------- 0137:00402B3B CALL [USER32!GetDlgItemTextA] Someone had real problems cracking this program and as the file size of the program was OK, I decided to have a quick look at it. I didn't think getting the serial number should be a big problem. Coding a KeyGEN for this should also be no problem. This *isn't* a KeyGEN tutorial, since I'm very VERY BUSY at the moment.

Well, first of all we need to enter some fake registration details. The program was soo good and filled my WINDOWS REGISTRATION information in automatically. Now we only have to fill in a Product Number. The product number already filled in looks like WDx.x-xxxxx-xxxxx. So the author gave us the information how the good code must look like. Well I also noticed the information Product Number is valid for any future versions of this program!

Well the version is 4.2 so I assumed the Product Number should be WD4.2-xxxxx-xxxxx ... and as you can find out on your own this is true. If it isn't 4.2, then you're just registered for a LIMITED TIME and the NAG at startup still pops up. However the good code is still the same - you just have to replace the number and version (x.x) with 4.2!

I enterd WD4.2-12345-67890 as fake registration code and set a BPX to HMEMCPY. Then I pressed OK. SoftICE popped up. Since there were 3 input fields, I skipped the first two pop ups. Then I pressed F12 until I reached the following code snippet:
 
  :0040797E    LEA     EDX,[EBP-10]
  :00407981    MOV     EAX,0045E40C
  :00407986    CALL    00450B94
  :0040798B    DEC     DWORD PTR [ESI+1C]
  :0040798E    LEA     EAX,[EBP-10]
  :00407991    MOV     EDX,00000002
  :00407996    CALL    00450B64
  :0040799B    CALL    00407608
  :004079A0    TEST    EAX,EAX                        ; is serial ok?
  :004079A2    JNZ     00407AE0                       ; if not => JMP

A scheme like this is very common. Some CALLs and then a JZ/JNZ instruction. To find the good serial you normally just have to trace into the CALL before the JZ/JNZ instruction - and that was it. And in this program that's also the case. Tracing in the CALL, you'll get the following code snippet:

  :00407608    PUSH    EBX
               ...
  :00407618    CALL    00450CE8                      ; get length of serial
  :0040761D    CMP     EAX,06                        ; serial 6 chars long
  :00407620    JLE     00407665
               ...
  :0040666A    CALL    00450CE8                      ; get length of name
  :0040766F    CMP     EAX,02                        ; name 2 chars long
  :00407672    JLE     004076B2
               ...
  :004076BC    MOVSX   EAX,BYTE PTR [ESI]            ; move char[counter] in EAX
               ...
  :004076CB    MOVSX   EDX,BYTE PTR [ESI]            ; move char[counter] in EDX
  :004076CE    PUSH    EDX
  :004076CF    CALL    004499C4                      ; convert to lower case
  :004076D4    POP     ECX
  :004076D5    MOVZX   ECX,DI
  :004076D8    IMUL    ECX,[004551D4]                ; DI * 15h
  :004076DF    MOVZX   EDX,DI
  :004076E2    IMUL    ECX,EDX                       ; ECX * EDX
  :004076E5    ADD     AX,CX                         ; add result to AX
  :004076E8    ADD     DI,AX                         ; add result of this loop to DI
  :004076EB    INC     EBX                           ; chars done + 1
  :004076EC    INC     ESI                           ; counter + 1
  :004076ED    PUSH    ESP
  :004076EE    CALL    00444C00
  :004076F3    POP     ECX
  :004076F4    CMP     EBX,EAX                       ; did all chars?
  :004076F6    JB      004077BC                      ; if not => JMP
  :004076F8    MOV     EAX,0045E408
  :004076FD    CALL    00450CE8                      ; get length of company
  :00407702    TEST    EAX,EAX                       ; no company enterd?
  :00407704    JZ      00407744                      ; if so => JMP
               ...
  :0040774E    MOVSX   EAX,BYTE PTR [ESI]            ; move char[counter] in EAX
               ...
  :0040775D    MOVSX   EDX,BYTE PTR [ESI]            ; move char[counter] in EDX
  :00407760    PUSH    EDX
  :00407761    CALL    004499C4
  :00407766    POP     ECX
  :00407767    MOVZX   ECX,BP
  :0040776A    IMUL    ECX,[004551D4]                ; ECX * 15h
  :00407771    MOVZX   EDX,BP
  :00407774    IMUL    ECX,EDX                       ; ECX * EDX
  :00407777    SUB     AX,CX                         ; substract result from AX
  :0040777A    ADD     BP,AX                         ; add result of this loop to BP
  :0040777D    INC     EBX                           ; chars done + 1
  :0040777E    INC     ESI                           ; counter + 1
  :0040777F    PUSH    ESP
  :00407780    CALL    00444C00
  :00407785    POP     ECX
  :00407786    CMP     EBX,EAX                       ; did all chars?
  :00407788    JB      0040784E                      ; if not => JMP
  :0040778A    MOVZX   EAX,BP                        ; get result for company in EAX (NR)
  :0040778D    MOVZX   ECX,DI                        ; get result for name in ECX    (CR)
  :00407790    PUSH    EAX
  :00407791    PUSH    ECX
  :00407792    PUSH    00455288
  :00407797    LEA     EAX,[ESP+0C]
  :0040779B    PUSH    EAX
  :0040779C    CALL    0044809C                      ; format serial: NR-CR
  :004077A1    ADD     ESP,10
  :004077A4    LEA     EAX,[ESP+40]                  ; get enterd serial
  :004077A8    MOV     EDX,ESP                       ; get real serial
  :004077AA    MOV     CL,[EAX]                      ; get part of fake serial
  :004077AC    CMP     CL,[EDX]                      ; part of serial correct?
  :004077AE    JNZ     004077C6                      ; if not => JMP
  :004077B0    TEST    CL,CL
  :004077B2    JZ      004077C6
  :004077B4    MOV     CL,[EAX+01]                   ; get part of fake serial
  :004077B7    CMP     CL,[EDX+01]                   ; part of serial correct?
  :004077BA    JNZ     004077C6                      ; if not => JMP
  :004077BC    ADD     EAX,02
  :004077BF    ADD     EDX,02
  :004077C2    TEST    CL,CL                         ; checked complete serial?
  :004077C4    JNZ     004078AA                      ; if not => JMP
  :004077C6    SETNZ   DL                            ; set flag

With the help of the comments in the code snippet you can understand the calculations for your serial. You can use this knowledge to code a KeyGEN if you have enough free time. The serial for the name PIRATED COPY and the company name CR@CKING TUTORI@L is WD4.2-16337-50000 - just for you to check your KeyGEN!

Another target has been Reverse Engineerd. Any questions (no crack requests)?

 
If you're USING Dictionary for Windows BEYOND it's FREE TRIAL PERIOD, then please BUY IT.

Copyright © 1999 by TORN@DO and The Immortal Descendants. All Rights Reserved. s set the