HOW TO CRACK BY ESTADO+PORCINO 
 
CHAPTER V. COLOR CRACK 
- How to Crack Multimedia Builder 3.0- 
 
November 1998
 
Index 
INTRODUCTION 

FIRST LOOK 

FIRST APPROACH 

ZEN CRACK  

CRACK IN COLORS 

CONCLUSION 
 
INTRODUCTION 

Target: Multimedia Builder 3.0 
Site: www.mediachance.com 
Tool: Our loved Sice and Zen crack.  

Today is a day of Heineiken, Coffee of Kenya, Moskovkaya, Guiness, Mahou and women.  

Good, we are back again with a new trick under the sleve: " Crack in Color " that we will apply to our target, the excellent Multimedia Builder. A program to create applications that include sound, image, video. Don't lose the CD player that comes with the example. 
 
FIRST LOOK  
Really this programmer has worked on it. He has closed most of the front doors to crackers, therefore it is necessary to open others like the " Crack in Color ". Let's see some of the author talents :  

- a serial number Exists that is introduced from " Help\About\Register " 

- When we introduce a false serial number does not appear any window showing an error. 
So we have to discard the classic " bpx messageboxexa ". 

- The important character chains are encypted, reason why we cannot look for them with the  
" Search and Replace ", which prevents crack in 5 minutes. 
 
FIRST APPROACH  
Rejected the typical attacks, we are going to enter by the classic door following the track of the false Serial. 

We put a garbage number " 12121212 ", Jumped to sice and we enter ' s 30:00 l ffffffff " 12121212 " ' 
In each case XX:xx we applied ' bpr XX:xx XX:xx+8 rw'. Once finished we push the OK button and BOOM, we appear in sice. F12 we arrived at routine " GetwindowTextA ". 
We leave this way because it is very boring.  

In the end we were able to isolate a routine in that it gives back 0 if we are registered and 1 if we are not. We can simulate it to be registered. And in fact " we obtained it ". Our name appears in the registry window. But there is a surprise. If we executed Project/Run it appears " unregistered... ". How it is possible? 

But IF we are registered. The thing is still worse, if we fought ourselves with the registry and we generated a valid serial number the things does not improve. What is happening here? 
ZEN CRACK 
If we have passed the satisfactorily registry algorithm , why aren't we registered?? 
Let us think, the only way of not being registered is that we do not pass any check. We know that we have passed one, soon must have another check elsewhere of the code.  

This programmer has thought a little. HE SEPARATED the serial checks.  
And what is still more interesting, in each check he analyzes different things. Thus, if a check goes completely is not guaranteed that the rest goes. 

We know since at least there are two checks (one that we happened and another one not). 
A nexus of union between the checks must exist: A variable that keeps the serial that we have introduced. But there are multiple variants here: first check can encrypt the serial for the second check, to modify the flag so that the second check is always false ...  

The question is: How do I locate the second check??  
The only track is the horrible yellow signboard ".. unregistered.. ". could be analyzed all the variables that the first algorithm modifies, but that is too expensive. We must look for another way. 
The only method to know that we have not passed the checks is the yellow signboard.  
It is that way by where we must attack. 

The message is encrypted, so we reject that way. 
The signboard seems a Label in the style of JAVA or Delphi, reason why it does not have own organization like a window. 
By where must we attack? 
CRACK IN COLORS  
Lets think, what is what more calls the attention of the signboard? its yellow color. 
This color must be assigned by any way. In fact the yellow seems that it is the color of bottom of the signboard. 
If we dissasemble our objective we'll see it uses the setbkcolor function. 
Therefore we must locate something similar to " setbkcolor(Yellow)". 
But how is expressed the yellow color exactly??  

Normally the colors are formed from the combination of the so called " basic colors ". 
The normal thing is to use like basic colors RGB="Red Green and Blue. " Our problem is like expressing the yellow of the signboard based on RGB. Luckily our yellow is a simple combination. We can use the list of colors of any program to verify it. In my case I have used Visual Coffee 2.5 (cracked of course). 
Introducing Red=255, Green=255, Blue=0 we obtain the same yellow that the one of the signboard.  

If the color had been more complex, we captured the screen with the signboard and we concerned a graphical publisher as Photoshop. We select a yellow pixel from the signboard and we see its components in terms of Red, Green and Blue. 

So we must locate something like " setbkcolor(255 255 0) ". We needed to know if more parameters for the setbkcolor exist. Looking at the API we find:   

COLORREF SetBkColor(HDC hdc,    // handle of device context  
                    COLORREF crColor    // background color value
                    );  
The COLORREF value is a 32-bit value used to specify an RGB color. 
When specifying an explicit RGB color, the COLORREF value has the following hexadecimal form: 
0x00bbggrr  
Our color is a whole number and it goes like second parameter. Since the number is stored the other way around we must look for SetBkColor(hdc, 0000ffff). Let us dust the manuals of  Sice, reason why we have ... 

bpx setbkcolor if (* (esp+8)==ffff0000) 

Let us explain a little thing that has appeared. bpx setbkcolor indicates that it is stopped when the setbkcolor routine is executed (* (esp+8)==00ffff), that is to say, when the content of registry EIP+8 is 00ffff. Remember that the parameters to the functions go through the stack (ESP=registry stack to pointer): 

Concretely it is ESP+8 because in two are piled up word of 4 bytes each one.   

Before Called call ESP=000 ESP=address of return (word of
4 bytes) ESP+4=parámetro HDC.(word of 4 bytes) ESP+8=second
parameter
Applying our bpx and pressing " Project/Run " BOOM, we appear in sice, to see if we are really before the correct setbkcolor, change to the color " d esp+8 " and happened of " FFFF00 " to " FFFFFF ". 
We obtain a pretty white color of bottom. Soon we have the correct call. We push f12 twice and later we see 

:460a15 cmp [ ESI+378], 43ca 

If the values are not equal we see the error message. Therefore this is the flag that controls everything. Only it is already enough to see who initializes it. But this is a known work by all, so I leave it like exercise. 

Notice how classic flag 1.0 is not used, instead a difficult value 0x43CA. A new symptom of which the author has read about cracks.
 
CONCLUSION  
We have learned a new technique: " Crack Color ". It could be applied when the message of " unregistered " is not a window but a chain within a window. 
We must find out the color that is applied to the message and place in the Sice: 

bpx RutineName if (* (esp+8)==00BBGGRR)  

You remember that the values of Blue(blue), Green (Green), Network (red) are hexa. 

When we appeared on Sice we are gonna change the color to see if we are in the correct window. In such case of looking for a jump that avoids the message. 

This technique always is appliable, but it is recommended when few colors in the window and the message exist is stood out of the rest (quite habitual thing).  

A possible generalization of is technique is applicable to the color of the type of  letter (foreground color), the type of source, (setFont), the aspect (italic...). You remember to make use of  a good Api aid for win32.  

We do not forget the protection scheme so original ( SEPARATION OF VERIFICATIONS ) that has implemented the author. Really interesting. 
Notes for the readers.  
1. - The messages of the type " Make me a crack for " Tell me how to crack... " Tell me where I can find... " automatically are ignored. The objective of these inept articles is to teach how to crack, not to teach how to beg. 

2. - I will only answer to theoretical questions on cracks, indicating some tips that facilitate the work. 

3. - Plz, write articles about your cracked programs.  
As anything it serves what you learn if you do not distribute it, rots to you in the head, word. 

4. - I haven't answered some interesting mails. From here my excuses. 

5. - If my articles were useful for you, plz send me an e-mail indicating it. Thanks  

Mr_PinK & WKT (Whiskey Kon Tekila)  

We wait for your opinions, suggestions and essays in estadoporcino@hotmail.com 
Shortly we will analyze much more interesting protections. 

Remember, drink of the source and look for +ORC in the net. 

This is my first translation and Really Sucks!!. Sorry. 
I hope you could understand something. If not..... LEARN SOME SPANISH.
Mr_WhiTe

No it does not sucks...... retouched by: nIabI