Cracking "Drag and View v 4.5"
Date: July 31, 1999
Author : +ViPeR+
[E]bola [V]irus [C]rew

Program Name : Drag and View v 4.5
Location     : http://www.canyonsw.com/

Method: COMPARE value based on the 

<<Note : this document is only for educational purpose ONLY>>
-------------------------------------------------------------------------------

First, the registration screen will show up when you exit this program.

Enter the following code in the text field: 11110000000000

Note: the length of the key should be 14 = E(hex)

'Ctrl-D' into Soft-Ice and set a breakpoint with 'bpx getdlgitemtexta'.
'Ctrl-D' to get out of Soft-Ice and click 'Ok' and you are back to Soft-ice.

'F11' and 'F10' until you are at 00402B2F. You will find the standard 
TEST, JUMP statements just below the function call. Hence, we need to trace
into the 'call 00402B70'.

:00402B1E FF1570BD4400            Call dword ptr [0044BD70]
:00402B24 FF352C5B4400            push dword ptr [00445B2C]
:00402B2A 8D45EC                  lea eax, dword ptr [ebp-14]
:00402B2D 50                      push eax
:00402B2E 56                      push esi
:00402B2F E83C000000              call 00402B70 <-- 'F8' into this call
:00402B34 83C40C                  add esp, 0000000C
:00402B37 85C0                    test eax, eax <-- standard TEST, JUMP
:00402B39 7417                    je 00402B52
:00402B3B 6A40                    push 00000040
:

After 'F8', we are at 00402B70.

'F10' until you reach at 00402B8F.

:00402B70 55                      push ebp
:00402B71 8BEC                    mov ebp, esp
:00402B73 56                      push esi
:00402B74 57                      push edi
:00402B75 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00402B78 57                      push edi
:00402B79 FF1508BA4400            Call dword ptr [0044BA08]
:00402B7F 83F80E                  cmp eax, 0000000E ; <-- compare length
:00402B82 7550                    jne 00402BD4 ; <-- jump is not equal
:00402B84 57                      push edi
:00402B85 33F6                    xor esi, esi
:00402B87 FF1564BD4400            Call dword ptr [0044BD64]
:00402B8D 33C9                    xor ecx, ecx

The following block of codes starts calculating a value based on your input 
key and the result is stored in ESI.

:00402B8F 8A0439                  mov al, byte ptr [ecx+edi] <-----
:00402B92 3C41                    cmp al, 41                       |
:00402B94 0FBEC0                  movsx eax, al                    |
:00402B97 7C06                    jl 00402B9F                      |
:00402B99 8D7406BF                lea esi, dword ptr [esi+eax-41]  | loops 
:00402B9D EB04                    jmp 00402BA3                     | through
:00402B9F 8D7406D0                lea esi, dword ptr [esi+eax-30]  | fake code
:00402BA3 83FE09                  cmp esi, 00000009                |
:00402BA6 7E03                    jle 00402BAB                     |
:00402BA8 83EE09                  sub esi, 00000009                |
:00402BAB 41                      inc ecx                          |
:00402BAC 83F90E                  cmp ecx, 0000000E                |
:00402BAF 7CDE                    jl 00402B8F                 <----   
:00402BB1 83FE04                  cmp esi, 00000004

If esi == 4, the program will execute the following 'call 00402C64'.

:00402BB4 750F                    jne 00402BC5
:00402BB6 FF7510                  push [ebp+10]
:00402BB9 FF7508                  push [ebp+08]
:00402BBC E8A3000000              call 00402C64

The following is the code list on 00402C64. From here, you can see that if
esi=4, you will see a message box shows up saying that  
"You have 30 more days to evaluate the program". If you close the program, 
and restart it again, when you exit the program, it still asks you to 
register it.

>>>> CALL 00402C64 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

* Referenced by a CALL at Address:
|:00402BBC   
|
:00402C64 837C240801              cmp dword ptr [esp+08], 00000001
:00402C69 7507                    jne 00402C72
:00402C6B 68E0114400              push 004411E0
:00402C70 EB05                    jmp 00402C77
:00402C72 6890114400              push 00441190
:00402C77 FF742408                push [esp+08]
:00402C7B E823000000              call 00402CA3
:00402C80 59                      pop ecx
:00402C81 85C0                    test eax, eax
:00402C83 59                      pop ecx
:00402C84 741A                    je 00402CA0
:00402C86 6A40                    push 00000040
:00402C88 68D4134400              push 004413D4
* Possible StringData Ref from Data Obj ->"You have 30 more days to evaluate "
                                        ->"the program"
:00402C8D 68A4134400              push 004413A4
:00402C92 FF742410                push [esp+10]
:00402C96 FF1574BD4400            Call dword ptr [0044BD74]
:00402C9C 6A01                    push 00000001
:00402C9E 58                      pop eax
:00402C9F C3                      ret

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

What if esi is not equal to 4?

If esi not equals 4, jump to 00402BC5.

:00402BC5 8B4510                  mov eax, dword ptr [ebp+10] ; eax=5
:00402BC8 3BF0                    cmp esi, eax
:00402BCA 7508                    jne 00402BD4
:00402BCC 48                      dec eax ; <-- notice this.
:00402BCD 7425                    je 00402BF4
:00402BCF 83E804                  sub eax, 00000004 ; <-- notice this.
:00402BD2 7419                    je 00402BED ; jump if zero flag is set.
                                              ; and this is the case when
					      ; eax = 0
:
:
:00402BED 6890114400              push 00441190
:00402BF2 EB05                    jmp 00402BF9
:00402BF4 68E0114400              push 004411E0
:00402BF9 E808000000              call 00402C06
:00402BFE 59                      pop ecx
:00402BFF 6A01                    push 00000001 <-- 
:00402C01 58                      pop eax <-- this is what we want, eax = 1
:00402C02 5F                      pop edi
:00402C03 5E                      pop esi
:00402C04 5D                      pop ebp
:00402C05 C3                      ret

From above, you can see that in order to register this program, the value
in ESI should be 5. 

So, what would be the easy way to make ESI have value 5 based on the input
we enter?
Answer: 11111000000000

Enter the above number and you are registered. And when you exit the program
, it won't ask you to register again. 



Final Note:
   I believe you can come up with thousands of ways to make ESI = 5.


Ob Duh
   Do I really have to remind you all that by buying and NOT stealing the 
   software you use will ensure that these software houses will continue to
   produce even *better* software for us to use and more importantly, to
   continue offering even more challenges to breaking their often weak
   protection systems.


+ViPeR+
[E]bola [V]irus [C]rew
July 31, 1999