tCA Tutorial on cracking a VB6 program - Tweaki for power users 2.7.3
Author:
YoKe
Target:
Tweaki... for power users 2.7.3
Tools needed: Softice 4.05 | Smart Check
6.03
Protection:
Serial
Tweaki is my first VB6 program i
cracked and i wanna show you how i done it.
Tweaki is a cool program, you get to mess
about with loads a things. Yes! but here we are interested in that
About/Register button undar options tab. So lets click on it and enter in any
silly name and serial and hit enter .. Damn it was obvious wrong serial. Lets
try again this time with Softice loaded!! But this is a Visual Basic Program so
a breakpoint on getwindowtexta or getdlgitemtexta or anything like that. So what
could we use? hmm i tried and looked up the imports in Win32Dasm. i
noticed too that look like string compares (could compare our serial to the
right one) MSVBVM60!__vbastrcmp also MSVBVM60!__vbastrcomp
but i put a breakpoint on these and clicked register, sure enough softice broke
but there is no real reference to the serial and muck traceing has to be done. (
note to but a breakpoint on a vb6 program this line must be added in winice.dat
with the imports: EXP=c:\windows\system\msvbvm60.dll )
So lets try a different plan, use Smartcheck 6.03 a visual basic debugger. Load it up. Make sure you have it setup correct ( there is some tuts on the net to do this) Now with smartcheck load up Tweaki.exe then press F5 to open the program with smartcheck. When it has finished loading register tweaki with name YoKe [tCA] and enter in any serial. Now hit Register. Go to smartcheck and search for Yoke [tCA] you should see:
Left&(String:"YoKe [tC...",
long:1)
Much more code, it looks like it examined every letter
separetly, Anyway go down until you see:
Double (1.05141e+008) --> String
(105141015")
<- hmm this looks like a serial!!! and right undar this
we see the invalid serial MsgBox and above we see the date and time see below *
So a serial is calculated from all that we've seen above what looks like a serial in smartcheck, so lets check the serial enter it in Tweaki ...... God! it doesn't work, it is a serial we know this because there is no other reference to a serial in smartcheck, maybe something is done with the serial or something is added on to the serial that is not showing up in smartcheck. At that point i had got an idea ...just follow along... Load up softice and enter in name: Yoke [tCA] and any serial (not the one above i will explain later) no press CTRL+D and type bpx hmemcpy to put a breakpoint on memory. Now hit F5 and click register. softice breaks now that we are going to do is search for our serial in memory, but i searched in hex so you do that. (if you do not now the char. in hex use a hex editor to findout) 105141015 in hex is 31 30 35 31 34 31 30 31 35 but you may know text in memory of a VBx program is in wide Char format it has a . in between the characters but its not a full stop who's hex is 2E its a different char who's hex is 00. So we will search for the serial in widechar in hex by typing in softice: s 0 l ffffffff 31 00 30 00 35 00 31 00 34 00 31 00 30 00 31 00 35 ( 1 . 0 . 5 . 1 . 4 . 1 . 0 . 1 . 5 )
So when you have typed s 0 l ffffffff 31 00 30 00 35 00 31 00 34 00 31 00 30 00 31 00 35 softice should find something and llook in the ascii window you should see something like:
....1.0.5.1.4.1.0.1.5.N.U.J......
Well cool?!! Our finished serial (we hope) type BC * to clear breakpoint and F5 to exit softice. Now in tweaki enter in Name: Yoke [tCA] Serial: 105141015NUJ and click register weyhey it says registered!!
note- NUJ seems to be but on the end of the serial that we get in smartcheck but i cracked this in june 2000 if i change the month to july 2000 the serial is invalid!! weird protection (* when i cracked 2.4.0 backsome time my serial was 105141015YAM. In other words the first part of the serial is always the same and the last part changes as the date changes but once you are registered you are always registered..) on 3 july 2000 the serial for me is 105141015LUJ
I hope you have learned something here mail me at yoke@tca2k.net if you didor if anything is incorrect here, if the tut if f**ked and wrong or you know a different way to crack this program. Or visit us at www.tca2k.net = tHE cRACKiNG aNSWER Chat to me in #tca2k or #cotd EFNet
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>